Craft CMS up to 4.18.1/5.10.5 Twig Sandbox elementId information disclosure

Summaryinfo

A vulnerability labeled as problematic has been found in Craft CMS up to 4.18.1/5.10.5. This affects an unknown function of the component Twig Sandbox. Executing a manipulation of the argument elementId can lead to information disclosure. This vulnerability is tracked as CVE-2026-72782. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Craft CMS up to 4.18.1/5.10.5. It has been declared as problematic. This vulnerability affects an unknown part of the component Twig Sandbox. The manipulation of the argument elementId with an unknown input leads to a information disclosure vulnerability. The CWE definition for the vulnerability is CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. As an impact it is known to affect confidentiality. CVE summarizes:

Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 interpolate environment variables and secrets (via ${ENV_VAR} strings in the elementId parameter) into Twig templates before rendering, even when the Twig sandbox is enabled. An authenticated attacker with control panel access can render a malicious sandboxed Twig template and, using a blind error-based technique across many requests, incrementally leak arbitrary environment variables and secrets. These can be abused to forge sessions (via CRAFT_SECURITY_KEY), escalate privileges, and steal database, SMTP, API, or blob storage credentials. Fixed in 5.10.6 and 4.18.2.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-72782 since 08/10/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1592.

Upgrading to version 4.18.2 or 5.10.6 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Content Management System

Name

• Craft CMS

Version

• 4.18.0
• 4.18.1
• 5.10.0
• 5.10.1
• 5.10.2
• 5.10.3
• 5.10.4
• 5.10.5

License

• free

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion