CVE-2026-92592: Craft CMS RCE Vulnerability

CVE-2026-92592 Overview

Craft CMS contains a remote code execution vulnerability affecting versions 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12. The flaw stems from a shared signing key between the license-shun cookie and signed redirect parameters. An authenticated non-administrator can transplant a signed cookie envelope into the redirect parameter. On successful login, Craft renders the attacker-controlled bytes as an unsandboxed Twig template. Twig's map filter accepts a string callback, allowing PHP system() to execute arbitrary commands as the web-server user. The vulnerability is categorized under [CWE-1336] (Improper Neutralization of Special Elements Used in a Template Engine).

Critical Impact
Authenticated attackers without Control Panel access can achieve remote code execution as the web-server user by abusing shared HMAC signing keys.

Affected Products

Craft CMS 4.8.0 through 4.18.5
Craft CMS 5.0.0 through 5.10.12
Deployments using password authentication without active 2FA and default request configuration

Discovery Timeline

2026-09-16 - CVE-2026-92592 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92592

Vulnerability Analysis

Craft CMS relies on Yii's cookieValidationKey, which is derived from the same Craft securityKey used to sign request parameters. Because the HMAC signature is not bound to a specific purpose or context, a signed envelope produced for one channel remains valid when presented in another. An authenticated user can set a signed value through the license-shun cookie endpoint, then move that signed blob into the login redirect parameter. Craft validates the signature successfully and passes the authenticated bytes to the Twig rendering pipeline. Twig executes the string in an unsandboxed context, and its map filter accepts arbitrary string callbacks, including PHP system(). The result is operating-system command execution under the web-server account.

Root Cause

The root cause is signature reuse across trust boundaries. HMAC verification confirms authenticity but does not distinguish between a cookie and a redirect parameter. This is a canonical example of [CWE-1336], where trusted input flows directly into a template engine that permits code execution primitives.

Attack Vector

Exploitation requires an authenticated account using password authentication with 2FA disabled. Control Panel access is not required. The attacker sets the license-shun cookie via its endpoint, extracts the signed value, and submits it as the redirect parameter during login. After authentication, Craft renders the string as a Twig template, invoking map with system as the callback to run arbitrary shell commands. Detailed exploitation mechanics are described in the GitHub Security Advisory GHSA-5r92-75j8-c534 and the VulnCheck Advisory for Craft CMS.

Detection Methods for CVE-2026-92592

Indicators of Compromise

Unusual POST requests to the license-shun endpoint from authenticated non-admin accounts
Login requests containing long, signed redirect parameter values matching the format of Craft signed cookies
Web-server processes (php-fpm, apache, nginx worker) spawning shell children such as sh, bash, curl, or wget
New files written under Craft web/, storage/, or template directories following successful logins

Detection Strategies

Correlate license-shun cookie mutations with subsequent login events reusing the same signed value in the redirect parameter
Alert on Twig template rendering errors or exceptions referencing the map filter with unexpected callback strings
Monitor process lineage for web-server users executing operating-system commands outside normal application behavior

Monitoring Recommendations

Enable verbose access logging that captures full query strings and cookie names on Craft CMS endpoints
Forward web-server and PHP error logs to a centralized analytics platform for correlation with authentication events
Baseline normal child-process activity for the web-server user and alert on deviations such as shell or network utility execution

How to Mitigate CVE-2026-92592

Immediate Actions Required

Upgrade Craft CMS to version 4.18.6 or 5.10.13 as documented in the vendor advisory
Rotate the Craft securityKey after patching to invalidate any previously captured signed envelopes
Enforce two-factor authentication for all accounts, particularly those using password authentication
Audit recent authentication events and web-server child processes for signs of exploitation

Patch Information

Craft CMS has released fixed versions 4.18.6 and 5.10.13. Both releases bind the HMAC signature to its purpose so that a value signed for the license-shun cookie cannot be replayed as a signed redirect parameter. Patch details are available in the GitHub Security Advisory GHSA-5r92-75j8-c534.

Workarounds

Disable PHP system() and related command-execution functions via the disable_functions directive in php.ini
Require 2FA for all authenticated users to remove the primary precondition for exploitation
Restrict account creation and review existing non-administrator accounts for unexpected access

bash

# Configuration example: restrict dangerous PHP functions in php.ini
disable_functions = system,exec,shell_exec,passthru,proc_open,popen