CVE-2026-55794High▾ MidnightPoC availableCraft CMS: Potential authenticated Remote Code Execution via referrer redirect
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Aug 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.3%
0.3% → 0.4%
1 GitHub repo
Control panel users with the ability to edit entries can execute unsandboxed Twig code via the HTTP Referrer header.
The issue happens when a user is saving entries. Strings for a signed redirect URL are being compiled as a Twig template via renderObjectTemplate(), and while a sandboxed alternative already exists (renderSandboxedObjectTemplate()), it is not used in this case. This signed URL can be specified by users, as it is reflected in the “Referer” HTTP request header, which is under attacker control.
This has been fixed in Craft 5.10.0. Affected users should update to that version or higher to get the fix.
https://github.com/craftcms/cms/pull/18680
craftcms/cms >= 5.9.0, < 5.10.0Upgrade to a patched release:
craftcms/cms 5.10.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
GHSA-86vw-x4ww-x467HighCraft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview
CVE-2026-115935High· 8.8Control panel only API response emulation replaces "securityKey" and reaches server RCE
CVE-2026-32267HighCraft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()
CVE-2025-32432Critical· 10.0Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond
CVE-2026-79987High· 8.8A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker.
GHSA-xxpx-f366-4xpqMediumCraft CMS:Authorization bypass: view-only Categories user can modify category structure via structures/move-element