GHSA-596p-6jv8-775v: Authenticated Leak of Secret Environment Variables in Craft CMS
Vulnerability ID: GHSA-596P-6JV8-775V
CVSS Score: 5.1
Published: 2026-08-06
An authenticated information disclosure vulnerability in Craft CMS allows high-privilege administrators to extract sensitive environment variables, including the CRAFT_SECURITY_KEY and database credentials, using a blind error-based template injection attack within element select condition rules.
TL;DR
Authenticated users can exfiltrate sensitive environment variables by abusing sequential evaluation of environment parsing and sandboxed Twig templates.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-1336
- Attack Vector: Network
- CVSS v4.0: 5.1
- Impact: Partial Information Disclosure
- Exploit Status: Proof-of-Concept
- Privileges Required: High (Admin Access)
- CISA KEV Status: No
Affected Systems
- Craft CMS 4.x systems prior to 4.18.2
- Craft CMS 5.x systems prior to 5.10.6
-
Craft CMS: >= 4.0.0-RC1, <= 4.18.1 (Fixed in:
4.18.2) -
Craft CMS: >= 5.0.0-RC1, <= 5.10.5 (Fixed in:
5.10.6)
Mitigation Strategies
- Upgrade Craft CMS installations to 4.18.2 (for 4.x branch) or 5.10.6 (for 5.x branch).
- Enforce strict IP restrictions and multi-factor authentication (MFA) on the Craft CMS Control Panel.
- Scan application databases periodically for unauthorized Twig payloads stored in condition rules.
Remediation Steps:
- Navigate to the root directory of the Craft CMS project.
- Execute the composer update command: 'composer update craftcms/cms' to fetch the patched version.
- Verify the installed package version using 'composer show craftcms/cms' to ensure it is at or above the designated patch versions.
- Run database and configuration audits to confirm no template-injection signatures reside in the system configurations.
References
Read the full report for GHSA-596P-6JV8-775V on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)