CVE-2026-55792 Details
Description
Craft CMS is a content management system (CMS). In versions starting from 4.0.0-RC1 and prior to 4.18.0, and 5.0.0-RC1 and above, prior to 5.10.0, the dataUrl() Twig function is included in Craft’s Twig sandbox allowlist, allowing any control panel user granted the utility:system-messages permission to embed a file-reading payload into system email templates. When those emails are sent, the server reads the target file and returns its contents as a base64-encoded data URL embedded in the email body. The .env file, which typically contains the database password, CRAFT_SECURITY_KEY, and third-party API keys, passes all of Craft’s existing dataUrl() protection checks and is fully exfiltrated. Obtaining CRAFT_SECURITY_KEY enables an attacker to forge session tokens and escalate to full admin account takeover. This issue has been fixed in versions 4.18.0 and 5.10.0.
A vulnerability in Craft CMS versions 4.0.0-RC1 prior to 4.18.0 and 5.0.0-RC1 prior to 5.10.0 allows for sensitive file disclosure through the dataUrl() Twig function. This function is improperly whitelisted in Craft's Twig sandbox, enabling control panel users with the utility:system-messages permission to embed file-reading payloads into system email templates. When these emails are sent, the server reads the specified file and encodes its contents as a base64 data URL, which is then embedded in the email body. Notably, the .env file, which contains critical information such as the database password, CRAFT_SECURITY_KEY, and third-party API keys, can be accessed because it bypasses Craft's dataUrl() protection checks. Exfiltrating the CRAFT_SECURITY_KEY allows an attacker to forge session tokens and gain full admin access.
Users can update to Craft CMS versions 4.18.0 or 5.10.0, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 2, 2026CISA-ADP
Assessed Jul 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/craftcms/cms/pull/18559 | CISA-ADP | Issue TrackingVendor |
| https://github.com/craftcms/cms/pull/18559 | [email protected] | Issue TrackingVendor |
| https://github.com/craftcms/cms/security/advisories/GHSA-287w-mxq6-x2cp | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Craft CMS | >= 4.0.0-RC1, < 4.18 ~5.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 2, 2026 | CVE Modified | CISA-ADP |
| Jul 2, 2026 | New CVE Received | [email protected] |