CVE-2026-92592
HighCVSS 8.8Summary
Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-controlled license-shun cookie with the same key and format used to validate signed redirect parameters, because the HMAC signature is not bound to its purpose. An authenticated, non-administrator user can set the cookie via the license-shun endpoint and transplant the signed envelope into the redirect parameter; on a successful login, Craft validates the signature and renders the authenticated bytes as an unsandboxed Twig template, where Twig's map filter accepts a string callback and allows PHP system() to execute arbitrary operating-system commands as the web-server user. Exploitation requires an account using password authentication without active 2FA, the default request configuration, and availability of PHP system(). The issue is fixed in 4.18.6 and 5.10.13.
Risk Assessment
An authenticated non-administrator user can execute arbitrary operating-system commands as the web-server user, leading to full host compromise.
Recommendation
Upgrade Craft CMS to version 4.18.6 or 5.10.13 (or later). Enforce 2FA for all accounts and consider disabling PHP system() at the PHP configuration level.
Other vulnerabilities in Craft CMS
See all- CVE-2026-92594High
Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorizes the GraphQL draftCreator and revisionCreator fields. Instead of requiring the user-data scope enforced by Gql::canQueryUsers(), these fields are gated only on elements.drafts:read / elements.revisions:read scopes, and their resolver returns a raw User element without per-field authorization. A client with only those scopes can harvest email addresses, usernames, full names, and postal addresses of all draft/revision creators. Fixed in 5.11.0.
- CVE-2026-92593High
Craft CMS versions 5.10.0 through 5.10.12 contain an incomplete fix for CVE-2026-55794: the Controller::getPostedRedirectUrl() -> View::renderObjectTemplate() sink remained unsandboxed, and the same fix commit added a self-signing oracle in Cp::elementLabelHtml(). Because Craft/Yii HMAC tokens are not bound to a parameter name, an authenticated low-privilege control panel user with edit rights on a single element type can mint a token over attacker-controlled Twig for the returnUrl parameter and replay it as the redirect POST parameter, reaching the unsandboxed sink and achieving server-side template injection that executes arbitrary PHP code. The issue is fixed in 5.10.13.
- CVE-2026-92591Medium
Craft CMS versions 5.0.0 through 5.10.12 treat a database connection failure as meaning Craft is not installed, making anonymous installer actions (including install/validate-site) reachable on an installed production site when PHP remains available but MySQL is not. An authenticated attacker with a valid guest session and CSRF token can read environment variables, including the security key, database credentials, or API keys. Fixed in 5.10.13.
- CVE-2026-92590Medium
Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in the Generated Fields feature that disables Twig autoescaping and fails to encode cached values. Content editors can inject malicious JavaScript through editable fields that executes in authenticated Control Panel sessions of higher-privileged users. Fixed in 5.10.13.
- CVE-2026-92589Medium
Craft CMS 5.0.0 through 5.10.12 contains a broken access control flaw in the nested-elements reorder endpoint. An authenticated user with view-only permissions can reorder Matrix blocks or Address fields in another author's content without save access.
- CVE-2026-84802Medium
Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure vulnerability in AssetsController::actionMoveInfo that fails to enforce volume permissions. Authenticated control panel users can submit POST requests to the assets/move-info endpoint with arbitrary folderIds to retrieve asset count and total storage size for volumes they cannot access.
- CVE-2026-84801High
Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers permission to mint password reset URLs for administrator accounts. Attackers can generate a valid reset URL and set a new password, enabling complete control-panel takeover.
- CVE-2026-84800High
Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 contain a missing authorization vulnerability in AssetsController::actionReplaceFile. When a request supplies sourceAssetId and targetFilename but omits assetId, the replacePeerFiles permission is never enforced, allowing an authenticated low-privilege author with replaceFiles permission to overwrite peer asset files.
- CVE-2026-84798High
Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite(). The method checks permissions only against the user's own provisional draft, then deletes the canonical element without re-checking, allowing an authenticated user without deleteEntriesForSite permission to hard-delete entries.
- CVE-2026-84797Medium
Craft CMS versions before 5.10.11 contain an authorization bypass vulnerability in ElementsController::actionDuplicate() that allows authenticated users with createEntries permission to delete peer provisional drafts. Attackers can exploit the deleteProvisionalDraft parameter to delete another user's unsaved draft without proper authorization checks, gaining access to the victim's in-progress content.
Original NVD description (English source)
Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-controlled license-shun cookie with the same key and format used to validate signed redirect parameters, because the HMAC signature is not bound to its purpose (Yii's cookieValidationKey is derived from the same Craft securityKey used for signed request parameters). An authenticated, non-administrator user (Control Panel access is not required) can set the cookie via the license-shun endpoint and transplant the signed envelope into the redirect parameter; on a successful login, Craft validates the signature and renders the authenticated bytes as an unsandboxed Twig template, where Twig's map filter accepts a string callback and allows PHP system() to execute arbitrary operating-system commands as the web-server user. Exploitation requires an account using password authentication without active 2FA, the default request configuration, and availability of PHP system(). The issue is fixed in 4.18.6 and 5.10.13.