SB2026110647 - Multiple vulnerabilities in Craft CMS

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110647

SB2026110647 - Multiple vulnerabilities in Craft CMS

Published: November 6, 2026

Security Bulletin ID SB2026110647
CSH Severity
High
Patch available
YES
Number of vulnerabilities 12
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 8% Medium 67% Low 25%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 12 vulnerabilities.


1) Improperly Controlled Modification of Dynamically-Determined Object Attributes (CVE-ID: N/A)

CWE-ID: CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated control panel user to gain administrator privileges in Craft CMS and promote every other account.

The vulnerability exists due to unsanitized query configuration accepted by getOwners() when invoked through sandboxed Twig templates in the relational-condition object template feature. An authenticated control panel user can submit a crafted template and nested reference element to invoke a PHP callable that grants administrator status to all accounts, including their own.


2) SQL injection (CVE-ID: N/A)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated attacker to read arbitrary Craft CMS database data, including password hashes and session tokens.

The vulnerability exists due to unsanitized GraphQL eager-load criteria allowing a crafted select argument to inject SQL expressions. An unauthenticated attacker can exploit a public schema permitting anonymous section or asset-volume reads but no user-group reads by querying an authored entry or an asset with a populated uploader to retrieve data beyond the schema’s scope.


3) SQL injection (CVE-ID: N/A)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to read and modify the Craft CMS application database and escalate to administrator.

The vulnerability exists due to unsanitized concatenation of the attribute parameter into SQL queries in the element search endpoint, where emulated prepared statements permit stacked query execution. An unauthenticated remote attacker can submit crafted search requests to modify an account's administrator flag, as demonstrated by updating and reading back that flag.


4) SQL injection (CVE-ID: N/A)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated control panel user to infer database information through blind SQL injection in Craft CMS.

The vulnerability exists due to insufficient validation of criteria passed to getNext() and getPrev() when rendering attacker-controlled relational conditions in the Twig sandbox. An authenticated control panel user can supply SQL expressions in query criteria and obtain a conditional oracle under the Craft database account, even with the sandbox enabled.


5) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to read content from sites excluded from a Craft CMS GraphQL Public Schema.

The vulnerability exists due to missing Sites-scope authorization for the GraphQL localized field when its siteId or site argument is omitted. An unauthenticated remote attacker can query /actions/graphql/api in a multi-site installation with an in-scope section shared across authorized and excluded sites to retrieve that section’s excluded-site content.


6) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to read entry content excluded from a Craft CMS GraphQL schema.

The vulnerability exists due to missing section-scope authorization in GraphQL prev/next traversal when a public schema or scoped private token exposes one section but withholds another sharing its entry type. An unauthenticated remote attacker can obtain a visible entry’s ID through a root query and chain next hops to enumerate entries and retrieve withheld custom-field content.


7) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated control panel user to read SVG content files outside the Craft CMS installation that the PHP process can access.

The vulnerability exists due to unrestricted path and alias resolution in the app/icon-svg endpoint when processing a supplied file path. An authenticated control panel user can post an arbitrary absolute path or alias to retrieve file contents if the file's actual content is SVG.


8) Improper privilege management (CVE-ID: N/A)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated attacker to take over a deactivated non-admin account and inherit its previously assigned direct permissions.

The vulnerability exists due to Craft CMS retaining direct permissions when public registration reuses a deactivated account instead of clearing those permissions. An unauthenticated attacker can register using the deactivated account’s identity and choose a new password, gaining access with the retained privileges when email verification is disabled.


9) Code Injection (CVE-ID: N/A)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged control panel user to execute arbitrary operating system commands as the PHP worker.

The vulnerability exists due to Craft CMS accepting newline characters in emulated X-Craft-Plugin-Licenses API response headers and writing them into .env through app/process-api-response-headers. A low-privileged control panel user with accessCp can inject an attacker-known CRAFT_SECURITY_KEY and, after Craft loads it, forge a signed login redirect that executes commands.


10) Improper Neutralization of Special Elements Used in a Template Engine (CVE-ID: N/A)

CWE-ID: CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated control panel user to execute attacker-selected PHP callables as the web server user.

The vulnerability exists due to property lookups bypassing Twig sandbox restrictions when Craft CMS evaluates an element-search condition as an object template. An authenticated control panel user can submit crafted conditions to recover the securityKey through observable search results, then forge signed parameters that reach unsandboxed template rendering and invoke PHP callables.


11) Improper Neutralization of Special Elements Used in a Template Engine (CVE-ID: N/A)

CWE-ID: CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a non-administrator control panel user to execute operating system commands with the PHP worker’s privileges.

The vulnerability exists due to reusable signatures for attacker-controlled Twig returnUrl templates generated by Craft CMS’s app/render-elements endpoint with hyperlink=true in a non-modal context. A non-administrator control panel user can supply a signed template as the login action’s redirect parameter and successfully authenticate, triggering unsandboxed template evaluation and command execution.


12) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated user to view directory structures in Craft CMS volumes they are not authorized to access.

The vulnerability exists due to missing authorization checks in the asset replacement volume browser when deleting a linked asset prompts replacement selection. An authenticated user with access to one volume can attempt to delete an entry-linked asset in that volume and browse all volumes' directory structures, but cannot see files.


Remediation

Install update from vendor's website.

References