CVE-2026-72782: Craft CMS Information Disclosure Flaw

CVE-2026-72782 Overview

Craft CMS contains an information disclosure vulnerability that allows authenticated attackers to leak environment variables and secrets through the Twig template sandbox. The flaw affects Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2. The application interpolates ${ENV_VAR} strings supplied in the elementId parameter into Twig templates before rendering, even when the sandbox is active. Attackers with control panel access can use a blind error-based technique across many requests to incrementally exfiltrate secrets. Leaked values include CRAFT_SECURITY_KEY, database credentials, SMTP passwords, API tokens, and blob storage keys. The issue is tracked under [CWE-668: Exposure of Resource to Wrong Sphere].

Critical Impact
Leaked secrets enable session forgery via CRAFT_SECURITY_KEY, privilege escalation, and theft of database, SMTP, API, and blob storage credentials.

Affected Products

Craft CMS versions >= 5.0.0-RC1 before 5.10.6
Craft CMS versions >= 4.0.0-RC1 before 4.18.2
Deployments relying on the Twig sandbox as a security boundary

Discovery Timeline

2026-08-11 - CVE-2026-72782 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72782

Vulnerability Analysis

Craft CMS processes the elementId request parameter and expands ${ENV_VAR} placeholders against process environment variables before passing the string into the Twig rendering pipeline. This interpolation occurs upstream of the Twig sandbox, so sandbox restrictions on templates provide no protection against the injected values. An authenticated user with control panel access can submit crafted elementId values that embed environment references into a template they control.

The attacker cannot read the interpolated value directly because the sandbox blocks output primitives. Instead, they perform a blind error-based oracle attack, constructing template expressions whose evaluation succeeds or fails depending on characters within the secret. Across many requests, the attacker reconstructs each secret character by character. The scope of leakage is limited only by which variables are exposed to the PHP process.

Root Cause

The root cause is a trust boundary violation. Environment variable substitution runs against user-controlled input before the sandbox enforces isolation, so secrets cross from the host process context into the sandboxed template context.

Attack Vector

Exploitation requires network access to the control panel and valid authenticated credentials with low privileges. The attacker submits repeated requests containing ${ENV_VAR} payloads in the elementId parameter and observes response behavior to infer secret contents. No user interaction is required. See the GitHub Security Advisory and the VulnCheck Advisory on Craft CMS for technical details.

Detection Methods for CVE-2026-72782

Indicators of Compromise

Control panel requests containing ${ sequences within the elementId parameter or related query strings
High volumes of repeated, near-identical requests from a single authenticated session targeting element rendering endpoints
Twig rendering errors correlated with the same session over a short window, consistent with blind error-based probing
Unexpected authentication events using session tokens that could indicate forged sessions signed with a leaked CRAFT_SECURITY_KEY

Detection Strategies

Inspect web server and application logs for elementId values containing ${ or environment variable names such as CRAFT_SECURITY_KEY, DB_PASSWORD, or SMTP_PASSWORD
Alert on control panel accounts generating abnormal error rates against Twig-rendering endpoints
Correlate control panel activity with outbound connections to unfamiliar hosts that could indicate exfiltration of harvested credentials

Monitoring Recommendations

Enable verbose logging on Craft CMS control panel routes and forward events to a centralized analytics platform
Monitor database, SMTP, and cloud storage services for authentication using credentials that should only be used by the Craft application host
Track issuance and validation of Craft session cookies to detect forged sessions after any suspected exposure

How to Mitigate CVE-2026-72782

Immediate Actions Required

Upgrade Craft CMS to version 5.10.6 or 4.18.2 without delay
Rotate CRAFT_SECURITY_KEY and invalidate existing sessions after patching
Rotate database, SMTP, API, and blob storage credentials that were accessible to the Craft process
Audit control panel user accounts and revoke access for unused or untrusted users

Patch Information

Craft CMS resolved the vulnerability in versions 5.10.6 and 4.18.2. The fix removes environment variable interpolation from user-controlled input paths that reach the Twig renderer. Refer to the GitHub Security Advisory GHSA-596p-6jv8-775v for release notes and remediation guidance.

Workarounds

Restrict control panel access to trusted networks using firewall or reverse proxy rules until patching is complete
Reduce the set of environment variables exposed to the PHP-FPM or web server process to the minimum required for operation
Enforce multi-factor authentication for all control panel accounts to raise the cost of obtaining the required foothold

bash

# Upgrade Craft CMS via Composer to a fixed release
composer require craftcms/cms:^5.10.6 --update-with-dependencies
# or, for the 4.x branch
composer require craftcms/cms:^4.18.2 --update-with-dependencies

# After upgrade, rotate the security key and clear caches
php craft setup/security-key
php craft clear-caches/all