CVE-2026-124430Craft CMS 5.10.0 before 5.11.2 RCE via app/render-elements Signing Oracle

Descripción

Craft CMS from 5.10.0 before 5.11.2 contains a remote code execution vulnerability that allows non-administrator control panel users to obtain HMAC-signed Twig templates via the app/render-elements endpoint. Attackers can submit the signed templated returnUrl as the login redirect parameter, triggering unsandboxed renderObjectTemplate() evaluation and executing OS commands as the PHP worker.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• GitHub Security Advisory (GHSA-qj3q-j7r4-428p) vendor-advisory
• VulnCheck Advisory: Craft CMS 5.10.0 before 5.11.2 RCE via app/render-elements Signing Oracle third-party-advisory