What’s Vulnerable › Vulnerabilities

CVE-2026-72782: Craft CMS 5.0.0-RC1 before 5.10.6 Environment Variable Leak

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-11 · updated 2026-10-24
• Weakness: CWE-668

Description

Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 interpolate environment variables and secrets (via ${ENV_VAR} strings in the elementId parameter) into Twig templates before rendering, even when the Twig sandbox is enabled. An authenticated attacker with control panel access can render a malicious sandboxed Twig template and, using a blind error-based technique across many requests, incrementally leak arbitrary environment variables and secrets. These can be abused to forge sessions (via CRAFT_SECURITY_KEY), escalate privileges, and steal database, SMTP, API, or blob storage credentials. Fixed in 5.10.6 and 4.18.2.

Affected products

• craftcms cms: from 5.0.0-RC1 before 5.10.6; from 4.0.0-RC1 before 4.18.2 — fixed in 4.18.2, 5.10.6

How to fix

Upgrade to a fixed version: craftcms cms 4.18.2, 5.10.6. Check the vendor advisory for mitigations.

References

• https://github.com/craftcms/cms/security/advisories/GHSA-596p-6jv8-775v
• https://www.vulncheck.com/advisories/craft-cms-rc1-before-environment-variable-leak

Get alerted when CVE-2026-72782 or the next vulnerability affects your stack