CVE-2026-55794: Craft CMS Authenticated RCE Vulnerability

CVE-2026-55794 Overview

Craft CMS contains a code injection vulnerability that allows authenticated control panel users to execute unsandboxed Twig template code. The flaw affects Craft CMS versions 5.9.0 through 5.9.x and is fixed in 5.10.0. When a user saves entries, the application compiles a signed redirect URL string as a Twig template using renderObjectTemplate() instead of the sandboxed renderSandboxedObjectTemplate(). Because the signed URL is reflected from the HTTP Referer header, an attacker with entry-editing privileges can inject Twig expressions that execute server-side, leading to authenticated remote code execution [CWE-94].

Critical Impact
Authenticated control panel users with entry-edit permissions can achieve remote code execution on the Craft CMS server through Twig template injection in the HTTP Referer header.

Affected Products

Craft CMS 5.9.0 through 5.9.x
Craft CMS versions prior to 5.10.0
Craft CMS installations exposing the control panel to authenticated editors

Discovery Timeline

2026-07-02 - CVE-2026-55794 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-55794

Vulnerability Analysis

The vulnerability is a server-side template injection (SSTI) affecting the entry-save workflow in the Craft CMS control panel. Craft CMS uses Twig as its templating engine and provides two rendering paths for object templates. The safe path, renderSandboxedObjectTemplate(), restricts access to dangerous functions, filters, and PHP objects. The unsafe path, renderObjectTemplate(), compiles Twig with full access to the runtime.

During entry save operations, Craft CMS compiles the signed redirect URL string as a Twig template through the unsandboxed renderer. The signed URL value originates from the Referer HTTP header, which is fully controllable by the client sending the request. An authenticated attacker with permission to edit entries can craft a request that carries a malicious Twig payload in the Referer header, causing the payload to be evaluated during template compilation.

Root Cause

The root cause is the selection of the wrong rendering function for user-influenced input. The signed redirect URL string should have been processed through renderSandboxedObjectTemplate(), which restricts Twig runtime capabilities. Instead, the code path passes the value to renderObjectTemplate(), exposing the full Twig environment to attacker-controlled input.

Attack Vector

Exploitation requires an authenticated control panel session with entry-edit rights. The attacker submits an entry-save request while setting the HTTP Referer header to a value containing Twig syntax. Craft CMS reflects the header into the signed redirect URL flow and compiles it as a Twig template. The injected expressions execute in the PHP context of the web application, enabling arbitrary command execution, file access, and lateral movement into the CMS host. Technical details are documented in the Craft CMS Security Advisory GHSA-f74w-488g-8x5r and the corresponding GitHub Pull Request #18680.

Detection Methods for CVE-2026-55794

Indicators of Compromise

HTTP requests to Craft CMS control panel entry-save endpoints containing Twig syntax such as {{, }}, {%, or %} in the Referer header
Unexpected PHP process spawning shell commands or writing files under the Craft CMS web root
Web server access logs showing entry-save POST requests originating from unusual Referer values or non-browser clients
New or modified files in Craft CMS storage/, config/, or template directories following an entry-save request

Detection Strategies

Inspect web server and application logs for Referer headers containing Twig delimiters or PHP function names during authenticated sessions
Correlate Craft CMS entry-save actions with subsequent child process creation by the PHP-FPM or web server process tree
Alert on outbound network connections initiated by the CMS process shortly after control panel POST requests

Monitoring Recommendations

Enable verbose audit logging for control panel user actions, especially entry creation and modification events
Monitor authentication logs for control panel accounts with entry-edit privileges and flag unusual session sources
Track file integrity across Craft CMS installation directories and alert on unexpected writes

How to Mitigate CVE-2026-55794

Immediate Actions Required

Upgrade Craft CMS to version 5.10.0 or later, which replaces the vulnerable call with the sandboxed template renderer
Audit all control panel accounts and remove entry-edit privileges from users who do not require them
Rotate control panel credentials and session secrets if compromise is suspected
Review web server and application logs for Referer headers containing Twig syntax since deploying any 5.9.x release

Patch Information

The fix is included in Craft CMS 5.10.0. The patch switches the signed redirect URL compilation from renderObjectTemplate() to renderSandboxedObjectTemplate(), restricting the Twig environment available to attacker-controlled input. Details are available in GitHub Pull Request #18680 and the GHSA-f74w-488g-8x5r advisory.

Workarounds

Restrict control panel access to trusted networks using a web application firewall or IP allowlist
Block or strip Referer headers containing Twig delimiters at an upstream proxy for control panel endpoints
Reduce the number of accounts with entry-edit permissions until the patch is applied

bash

# Upgrade Craft CMS to the patched version via Composer
composer require craftcms/cms:^5.10.0 --update-with-dependencies
php craft up