CVE-2026-124430Craft CMS 5.10.0 before 5.11.2 RCE via app/render-elements Signing Oracle

Beschreibung

Craft CMS from 5.10.0 before 5.11.2 contains a remote code execution vulnerability that allows non-administrator control panel users to obtain HMAC-signed Twig templates via the app/render-elements endpoint. Attackers can submit the signed templated returnUrl as the login redirect parameter, triggering unsandboxed renderObjectTemplate() evaluation and executing OS commands as the PHP worker.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• GitHub Security Advisory (GHSA-qj3q-j7r4-428p) vendor-advisory
• VulnCheck Advisory: Craft CMS 5.10.0 before 5.11.2 RCE via app/render-elements Signing Oracle third-party-advisory