Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-115938— Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE

Quick assessment

Affected
craftcms cms
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Craft CMS 允许任何已登录的控制台用户提交一个元素搜索条件，该条件中的元素选择器会被当作沙箱化的 Twig 对象模板进行求值。Craft 所允许的列过滤器将属性查找委托给 Yii 的 ArrayHelper，而这一过程发生在 Twig 的 SecurityPolicy 沙箱之外。因此，通过反复执行单段属性查找，攻击者可以绕过沙箱对空属性/方法的白名单限制。 受影响的条件值最终会被强制转换为整数。但这并不能保护密钥安全：模板可以在猜测的密钥字符正确时返回作者 ID 1，而在其他情况下返回一个不可能的 ID。相

CVSS 8.8 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-115938

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE
Source: CVE Program / CVE List V5
Vulnerability Description
Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed column filter delegates property lookup to Yii ArrayHelper, outside Twig’s SecurityPolicy. Repeated single-segment lookups therefore bypass the sandbox’s empty property/method allowlists. The vulnerable condition value is ultimately cast to an integer. That does not protect the secret: the template can return author ID 1 when a guessed key character is correct and an impossible ID otherwise. The JSON endpoint returns entries for the first case and an empty array for the second, forming a stable remote character oracle. After recovering GeneralConfig::securityKey, the same user can compute Craft’s generic HMAC wire format offline. Signed parameters such as redirect are then accepted and passed to unsandboxed View::renderObjectTemplate(), where Twig’s string-callable form can invoke native PHP callables. The regression proof uses the harmless substr() callback and observes abcdef becoming cdef; it does not execute an OS command.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1336
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
craftcms cms 5.0.0 ~ 5.11.2 -

II. Public POCs for CVE-2026-115938

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-115938

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-115938 (1)

Security Blog Posts for CVE-2026-115938 (1)

Vendor Pages for CVE-2026-115938 (2)

Same Patch Batch · craftcms · 2026-10-23 · 3 CVEs total

CVE-2026-115935 8.8 HIGH Control panel only API response emulation replaces "securityKey" and reaches server RCE
CVE-2026-115937 7.5 HIGH Unauthenticated payment reuse allows unpaid orders to be marked as paid

IV. Related Vulnerabilities

Same product: cms
Same vendor: craftcms
Same weakness: CWE-1336

V. Comments for CVE-2026-115938

No comments yet

Leave a comment