{"id":"CVE-2026-124430","published":"2026-11-08T14:18:08.990","lastModified":"2026-11-10T21:46:24.793","description":"Craft CMS from 5.10.0 before 5.11.2 contains a remote code execution vulnerability that allows non-administrator control panel users to obtain HMAC-signed Twig templates via the app/render-elements endpoint. Attackers can submit the signed templated returnUrl as the login redirect parameter, triggering unsandboxed renderObjectTemplate() evaluation and executing OS commands as the PHP worker.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-1336"],"vendors":[],"products":[],"references":[{"url":"https://github.com/craftcms/cms/security/advisories/GHSA-qj3q-j7r4-428p","tags":[]},{"url":"https://www.vulncheck.com/advisories/craft-cms-5.10.0-before-5.11.2-rce-via-app-render-elements-signing-oracle","tags":[]}],"exploitRefs":[{"url":"https://github.com/craftcms/cms/security/advisories/GHSA-qj3q-j7r4-428p","tags":[]}],"hasPoc":true,"ai":{"summary":"A flaw in Craft CMS (5.10.0–5.11.1) allows non-admin control panel users to exploit HMAC-signed Twig templates via the app/render-elements endpoint, leading to remote code execution through unsandboxed template rendering. Attackers abuse the login redirect mechanism to trigger arbitrary OS command execution as the PHP worker.","exploitability":"Exploitation requires valid non-admin control panel credentials and knowledge of the vulnerable endpoint; public exploits exist, making it trivial for attackers with low privileges.","blast_radius":"Successful exploitation grants full system compromise with root-level privileges on the web server, enabling data theft, lateral movement, and persistent backdoor installation.","remediation":"Upgrade to Craft CMS 5.11.2 or later immediately; if upgrading is delayed, disable the app/render-elements endpoint for non-admin users and enforce strict access controls via web application firewall rules.","detection":"Monitor for anomalous POST requests to /index.php?p=admin/actions/app/render-elements with a returnUrl parameter containing signed Twig templates (e.g., base64-encoded strings ending in .html.twig or containing {{ }} syntax), especially when followed by unexpected PHP process spawning or filesystem writes in web-accessible directories.","tags":["rce","template-injection","auth-bypass","webapp","craft-cms"],"model":"garnet-coder","analyzedAt":"2026-11-09T09:45:52.374Z"}}