CVE-2026-55792

{
  "id": "CVE-2026-55792",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-02T00:16:44.940",
  "lastModified": "2026-10-25T21:10:00.770",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Craft CMS is a content management system (CMS). In versions starting from 4.0.0-RC1 and prior to 4.18.0, and 5.0.0-RC1 and above, prior to 5.10.0, the dataUrl() Twig function is included in Craft’s Twig sandbox allowlist, allowing any control panel user granted the utility:system-messages permission to embed a file-reading payload into system email templates. When those emails are sent, the server reads the target file and returns its contents as a base64-encoded data URL embedded in the email body. The .env file, which typically contains the database password, CRAFT_SECURITY_KEY, and third-party API keys, passes all of Craft’s existing dataUrl() protection checks and is fully exfiltrated. Obtaining CRAFT_SECURITY_KEY enables an attacker to forge session tokens and escalate to full admin account takeover. This issue has been fixed in versions 4.18.0 and 5.10.0."
    },
    {
      "lang": "es",
      "value": "Craft CMS es un sistema de gestión de contenido (CMS). En versiones a partir de 4.0.0-RC1 y anteriores a 4.18.0, y 5.0.0-RC1 y superiores, anteriores a 5.10.0, la función Twig dataUrl() está incluida en la lista de permitidos (allowlist) del sandbox de Twig de Craft, permitiendo a cualquier usuario del panel de control con el permiso utility:system-messages incrustar una carga útil (payload) de lectura de archivos en las plantillas de correo electrónico del sistema. Cuando se envían esos correos electrónicos, el servidor lee el archivo objetivo y devuelve su contenido como una URL de datos codificada en base64 incrustada en el cuerpo del correo electrónico. El archivo .env, que normalmente contiene la contraseña de la base de datos, CRAFT_SECURITY_KEY y claves API de terceros, pasa todas las comprobaciones de protección dataUrl() existentes de Craft y es completamente exfiltrado. La obtención de CRAFT_SECURITY_KEY permite a un atacante falsificar tokens de sesión y escalar a una toma de control completa de la cuenta de administrador. Este problema ha sido solucionado en las versiones 4.18.0 y 5.10.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "craftcms",
          "product": "cms",
          "versions": [
            {
              "version": ">= 4.0.0-RC1, < 4.18.0",
              "status": "affected"
            },
            {
              "version": ">= 5.0.0-RC1, < 5.10.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 6.0,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-02T14:48:43.714822Z",
          "id": "CVE-2026-55792",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/craftcms/cms/pull/18559",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/craftcms/cms/security/advisories/GHSA-287w-mxq6-x2cp",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/craftcms/cms/pull/18559",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}