Craft CMS up to 4.18.8/5.11.1 Element Search renderObjectTemplate sandbox

Summaryinfo

A vulnerability classified as critical was found in Craft CMS up to 4.18.8/5.11.1. The impacted element is the function View::renderObjectTemplate of the component Element Search. The manipulation results in sandbox. This vulnerability was named CVE-2026-115938. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Craft CMS up to 4.18.8/5.11.1. It has been classified as critical. Affected is the function View::renderObjectTemplate of the component Element Search. The manipulation with an unknown input leads to a sandbox vulnerability. CWE is classifying the issue as CWE-265. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed column filter delegates property lookup to Yii ArrayHelper, outside Twig’s SecurityPolicy. Repeated single-segment lookups therefore bypass the sandbox’s empty property/method allowlists. The vulnerable condition value is ultimately cast to an integer. That does not protect the secret: the template can return author ID 1 when a guessed key character is correct and an impossible ID otherwise. The JSON endpoint returns entries for the first case and an empty array for the second, forming a stable remote character oracle. After recovering GeneralConfig::securityKey, the same user can compute Craft’s generic HMAC wire format offline. Signed parameters such as redirect are then accepted and passed to unsandboxed View::renderObjectTemplate(), where Twig’s string-callable form can invoke native PHP callables. The regression proof uses the harmless substr() callback and observes abcdef becoming cdef; it does not execute an OS command.

The advisory is shared for download at hckrt.com. This vulnerability is traded as CVE-2026-115938 since 10/23/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1611.

Upgrading to version 4.18.9 or 5.11.2 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Content Management System

Name

• Craft CMS

Version

• 4.18.0
• 4.18.1
• 4.18.2
• 4.18.3
• 4.18.4
• 4.18.5
• 4.18.6
• 4.18.7
• 4.18.8
• 5.11.0
• 5.11.1

License

• free

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion