{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "craftcms cms: important CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/craftcms--cms/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/craftcms--cms/important.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-115938/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-115938/",
   "title": "CVE-2026-115938 · craftcms cms · disclosed",
   "content_text": "Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed column filter delegates property lookup to Yii ArrayHelper, outside Twig’s SecurityPolicy. Repeated single-segment lookups therefore bypass the sandbox’s empty property/method allowlists.\n\n\n\nThe vulnerable condition value is ultimately cast to an integer. That does not protect the secret: the template can return author ID 1 when a guessed key character is correct and an impossible ID otherwise. The JSON endpoint returns entries for the first case and an empty array for the second, forming a stable remote character oracle.\n\n\n\nAfter recovering GeneralConfig::securityKey, the same user can compute Craft’s generic HMAC wire format offline. Signed parameters such as redirect are then accepted and passed to unsandboxed View::renderObjectTemplate(), where Twig’s string-callable form can invoke native PHP callables. The regression proof uses the harmless substr() callback and observes abcdef becoming cdef; it does not execute an OS command.",
   "date_published": "2026-10-23T21:58:51Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-115935/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-115935/",
   "title": "CVE-2026-115935 · craftcms cms · disclosed",
   "content_text": "The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user.\n\n\n\nA non-admin user with only accessCp can place newline characters in X-Craft-Plugin-Licenses. Craft passes this value to its .env writer without removing the newlines.\n\n\n\nThis lets the user insert a new attacker-known CRAFT_SECURITY_KEY into .env. After Craft loads that key, the user can forge a signed login redirect containing a Twig system() callback.\n\n\n\nThis is different from the previous report. That report reads the existing key through a Twig sandbox bypass. This report replaces the key through fake API headers and CRLF injection. Fixing either source does not fix the other.",
   "date_published": "2026-10-23T21:40:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-112777/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-112777/",
   "title": "CVE-2026-112777 · craftcms cms · disclosed",
   "content_text": "Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its class-name checks are case-sensitive while PHP class resolution is not. Attackers with template-execution rights, such as Control Panel administrators, can instantiate SplFileObject via a lowercase class name to read .env secrets or write a PHP file into the webroot for remote code execution.",
   "date_published": "2026-10-19T19:10:54Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-112776/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-112776/",
   "title": "CVE-2026-112776 · craftcms cms · disclosed",
   "content_text": "Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite() is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete entries, categories, tags, and assets shared across sites.",
   "date_published": "2026-10-19T19:10:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-112775/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-112775/",
   "title": "CVE-2026-112775 · craftcms cms · disclosed",
   "content_text": "Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate them for active users. Attackers who obtain a victim's emailed code can submit it to users/set-password after the victim verifies an email change, resetting the password and taking over the account.",
   "date_published": "2026-10-19T19:10:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-112774/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-112774/",
   "title": "CVE-2026-112774 · craftcms cms · disclosed",
   "content_text": "Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to inject Yii behaviors by supplying a JSON-string field layout to ContentBlock::setFieldLayout(). Attackers with allowAdminChanges enabled can include 'as X' or 'on X' keys that bypass cleanseConfig() to execute OS commands as the web user and disclose secrets.",
   "date_published": "2026-10-19T19:10:52Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-112773/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-112773/",
   "title": "CVE-2026-112773 · craftcms cms · disclosed",
   "content_text": "Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by passing uncleansed criteria to getNext, getPrev, or getOwners. Attackers can inject Yii \"as\" or \"on\" config keys to attach malicious event handlers that execute when the element query runs, achieving code execution as the web user.",
   "date_published": "2026-10-19T19:10:51Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-112772/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-112772/",
   "title": "CVE-2026-112772 · craftcms cms · disclosed",
   "content_text": "Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox via Asset::getMimeType transforms. Attackers can supply 'as' or 'on' keys passed unfiltered to Craft::createObject, attaching malicious behaviors or event handlers that execute code as the web user.",
   "date_published": "2026-10-19T19:10:51Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-112770/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-112770/",
   "title": "CVE-2026-112770 · craftcms cms · disclosed",
   "content_text": "Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in the Twig group filter, which invokes non-string arrow arguments as callables without the checkArrow guard used by other arrow-accepting filters. Authenticated control panel users can pass an array-callable such as FileHelper::writeToFile via element-select condition rules to write a webshell to the webroot and execute code as the web user.",
   "date_published": "2026-10-19T19:10:49Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-109308/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-109308/",
   "title": "CVE-2026-109308 · craftcms cms · disclosed",
   "content_text": "Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates' request parameter in AppController::actionCacheUpdates to UpdatesModel without Component::cleanseConfig(), allowing behavior and event-handler injection. Authenticated control panel users with the performUpdates permission or Updates-utility access can supply 'as' or 'on' keys, such as an AttributeTypecastBehavior gadget, to execute arbitrary code.",
   "date_published": "2026-10-12T16:05:04Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-109305/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-109305/",
   "title": "CVE-2026-109305 · craftcms cms · disclosed",
   "content_text": "Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows non-admin users to invoke PHP callables through the \"has some\" and \"has every\" operators. Users with the System Messages permission can supply two-argument callables such as passthru or system in sandboxed templates to execute code as the web user.",
   "date_published": "2026-10-12T16:05:01Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-105985/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-105985/",
   "title": "CVE-2026-105985 · craftcms cms · disclosed",
   "content_text": "Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components.\n\n\n\nAny authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding an EntryType object’s uiLabelFormat and then rendering an Entry that resolves the same request-cached entry type, an attacker can cause arbitrary Twig supplied in the request to be evaluated by renderObjectTemplate().\n\n\n\nThis render path is not sandboxed. A Twig string callable can therefore reach PHP functions such as system(), resulting in operating-system command execution with the privileges of the PHP/web-server process.\n\n\n\nThe issue was reproduced with an active non-admin Craft Team user with no optional permissions enabled. No access to entry-editing, Settings, utility, user-management, project-config, filesystem, Kubernetes, or environment variables was required.",
   "date_published": "2026-10-06T10:23:25Z"
  }
 ]
}