CVE-2026-55792: Craft CMS Information Disclosure Flaw

CVE-2026-55792 Overview

CVE-2026-55792 is an information disclosure vulnerability in Craft CMS, an open-source content management system. The flaw stems from the dataUrl() Twig function being included in Craft's Twig sandbox allowlist. A control panel user granted the utility:system-messages permission can embed a file-reading payload into system email templates. When those emails are dispatched, the server reads the target file and returns its contents as a base64-encoded data URL in the email body. Attackers can exfiltrate the .env file, which typically contains database credentials, CRAFT_SECURITY_KEY, and third-party API keys [CWE-200].

Critical Impact
Exfiltration of CRAFT_SECURITY_KEY allows an attacker to forge session tokens and escalate to full admin account takeover.

Affected Products

Craft CMS versions 4.0.0-RC1 through 4.17.x
Craft CMS versions 5.0.0-RC1 through 5.9.x
Fixed in Craft CMS 4.18.0 and 5.10.0

Discovery Timeline

2026-07-02 - CVE-2026-55792 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-55792

Vulnerability Analysis

Craft CMS renders system email templates through a sandboxed Twig environment. The sandbox maintains an allowlist of functions considered safe for use in user-editable templates. The dataUrl() helper, intended to embed images and other assets as base64 data URLs within emails, was included in that allowlist. The function performs validation checks on the requested resource, but those checks do not exclude sensitive server-side files such as the application's .env configuration file.

An authenticated control panel user with the utility:system-messages permission can modify a system message template to invoke dataUrl() against an arbitrary path. When Craft sends the corresponding email, the server reads the referenced file, encodes it, and delivers the encoded content to the recipient inbox. This transforms a template-editing capability into an arbitrary file read primitive.

Root Cause

The root cause is an overly permissive sandbox allowlist. The dataUrl() function was treated as safe because its intended use case involves benign image assets. Its existing protection checks validate that the target resolves to a readable file, but do not enforce a boundary that excludes application secrets or configuration files such as .env.

Attack Vector

Exploitation requires an authenticated control panel account holding the utility:system-messages permission. The attacker modifies a system email template to call dataUrl() on the path of the .env file. Triggering the email flow (for example, a password reset or notification message) causes the server to embed the base64-encoded contents of .env in the outbound email. The attacker then decodes CRAFT_SECURITY_KEY and uses it to forge signed session tokens, resulting in privilege escalation to a full administrator account.

// Example exploitation is described in the vendor advisory.
// See: https://github.com/craftcms/cms/security/advisories/GHSA-287w-mxq6-x2cp

Detection Methods for CVE-2026-55792

Indicators of Compromise

Unexpected modifications to system message templates in the Craft CMS control panel, particularly containing dataUrl Twig function calls referencing paths outside the web root.
Outbound emails from the Craft mail queue with unusually large base64-encoded payloads embedded in the message body.
Access to the utility:system-messages area by low-privilege or newly created control panel accounts.

Detection Strategies

Audit the system_messages table and template storage for references to dataUrl( combined with file paths such as .env, config/, or absolute filesystem paths.
Review Craft CMS audit logs for edits to system messages, correlating the actor, timestamp, and template content.
Inspect mail transport logs for large outbound messages sent shortly after a system message template was modified.

Monitoring Recommendations

Enable and centralize Craft CMS admin activity logs, forwarding template modification events to a SIEM for correlation.
Alert on any control panel permission grant that adds utility:system-messages to a non-administrator role.
Monitor filesystem access to .env and other secret files from the PHP-FPM or web server process outside of expected application startup.

How to Mitigate CVE-2026-55792

Immediate Actions Required

Upgrade Craft CMS to version 4.18.0 or 5.10.0 without delay.
Rotate CRAFT_SECURITY_KEY, database credentials, and any third-party API keys stored in .env after patching, assuming compromise until proven otherwise.
Invalidate existing session tokens and force re-authentication for all control panel users.
Review recent system message template changes and the accounts that made them.

Patch Information

The issue is fixed in Craft CMS 4.18.0 and 5.10.0. The remediation removes dataUrl() from the Twig sandbox allowlist so that user-editable templates can no longer invoke it. See the Craft CMS Security Advisory GHSA-287w-mxq6-x2cp and the corresponding GitHub Pull Request #18559 for implementation details.

Workarounds

Revoke the utility:system-messages permission from all non-administrator roles until the upgrade is applied.
Restrict filesystem permissions on .env so that the PHP process cannot read it directly, using environment variables provided by the process manager instead.
Place the Craft CMS control panel behind network access controls or VPN restrictions to limit exposure of authenticated attack surface.

bash

# Upgrade Craft CMS via Composer to a patched release
composer require craftcms/cms:^5.10.0 -w
# or for the 4.x branch
composer require craftcms/cms:^4.18.0 -w
php craft up