CVE-2026-72782 in Craft CMS
Summary
by MITRE • 08/11/2026
Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 interpolate environment variables and secrets (via ${ENV_VAR} strings in the elementId parameter) into Twig templates before rendering, even when the Twig sandbox is enabled. An authenticated attacker with control panel access can render a malicious sandboxed Twig template and, using a blind error-based technique across many requests, incrementally leak arbitrary environment variables and secrets. These can be abused to forge sessions (via CRAFT_SECURITY_KEY), escalate privileges, and steal database, SMTP, API, or blob storage credentials. Fixed in 5.10.6 and 4.18.2.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability affects Craft CMS versions from 5.0.0-RC1 through 5.10.5 and 4.0.0-RC1 through 4.18.1, representing a critical server-side template injection flaw that bypasses Twig sandbox protections. The issue stems from improper input sanitization where environment variable references in the form of ${ENV_VAR} strings within the elementId parameter are interpolated into Twig templates before rendering occurs. This represents a direct violation of secure coding principles and falls under CWE-134, which describes the use of format strings with dynamic values without proper validation or sanitization.
The technical implementation allows authenticated attackers with access to the control panel to craft malicious requests that leverage the Twig sandbox bypass mechanism. When the system processes these requests, it performs variable interpolation on environment variables before the sandboxed template rendering occurs, effectively undermining the security controls designed to prevent arbitrary code execution. The vulnerability operates through a blind error-based technique where attackers make multiple requests to systematically extract sensitive information by observing error responses or timing variations.
The operational impact of this vulnerability is severe and multifaceted, as it enables credential theft and session manipulation that can lead to complete system compromise. Attackers can extract critical secrets such as CRAFT_SECURITY_KEY values that allow them to forge authentication sessions, escalate privileges within the application, and gain unauthorized access to backend systems. The stolen credentials can include database connection strings, SMTP server configurations, API keys, and blob storage access tokens that provide persistent access to sensitive data repositories and communication channels.
The exploitation technique relies on the attacker's ability to make multiple requests while monitoring responses for error patterns or timing differences that reveal character-by-character extraction of environment variables. This blind injection approach requires patience but is highly effective against systems where traditional direct output mechanisms are not available. The vulnerability essentially transforms a controlled access point into a privilege escalation vector, allowing attackers to move laterally within the system and potentially gain access to other applications or services that share the same environment variables.
Mitigation strategies should focus on immediate patching of affected versions to 5.10.6 or 4.18.2, which contain the necessary security fixes for proper environment variable sanitization before template interpolation occurs. Organizations should also implement additional monitoring for unusual request patterns and authentication attempts that might indicate exploitation activity. Network segmentation and principle of least privilege access controls can help limit the potential damage if an attacker does gain access through this vulnerability. The fix addresses the core issue by ensuring that environment variable interpolation occurs only after proper sanitization and validation, preventing the bypass of Twig sandbox restrictions that were designed to protect against such injection attacks.