CVE-2026-92593 Overview
CVE-2026-92593 is an authenticated server-side template injection (SSTI) vulnerability in Craft CMS versions 5.10.0 through 5.10.12. The flaw stems from an incomplete fix for CVE-2026-55794, where the Controller::getPostedRedirectUrl() to View::renderObjectTemplate() sink remained unsandboxed. An authenticated low-privilege control panel user with edit rights on a single element type can exploit a self-signing oracle introduced in Cp::elementLabelHtml() to mint a valid Yii HMAC token over attacker-controlled Twig payload. Replaying that token as the redirect POST parameter reaches the unsandboxed sink and executes arbitrary PHP code, resulting in full server compromise. The issue is fixed in Craft CMS 5.10.13.
Critical Impact
Authenticated low-privilege attackers can achieve remote code execution and full server compromise by abusing an HMAC token oracle and an unsandboxed Twig template sink.
Affected Products
- Craft CMS 5.10.0
- Craft CMS versions 5.10.1 through 5.10.12
- Fixed in Craft CMS 5.10.13
Discovery Timeline
- 2026-09-16 - CVE-2026-92593 published to the National Vulnerability Database
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-92593
Vulnerability Analysis
Craft CMS uses Yii's Hash-based Message Authentication Code (HMAC) tokens to protect signed parameters. The tokens are not bound to a specific parameter name, which enables cross-parameter token reuse. The patch for CVE-2026-55794 introduced a helper in Cp::elementLabelHtml() that signs attacker-influenced values, creating a signing oracle. An authenticated user with edit rights on any single element type can request a page that invokes this helper, causing the server to produce a valid HMAC over a Twig template payload embedded in the returnUrl parameter. The attacker then replays that signed value as the redirect POST parameter on a controller action that calls Controller::getPostedRedirectUrl(). This method passes the value to View::renderObjectTemplate(), which evaluates Twig outside a sandbox. The result is arbitrary PHP execution in the Craft application context [CWE-94].
Root Cause
Two defects combine to produce the vulnerability. First, View::renderObjectTemplate() reachable through getPostedRedirectUrl() was never placed inside the Twig sandbox after the prior fix. Second, the HMAC scheme signs values without binding them to the parameter name, allowing a token minted for returnUrl to be accepted as redirect.
Attack Vector
Exploitation requires an authenticated control panel account with edit rights on at least one element type. The attacker triggers Cp::elementLabelHtml() to sign a Twig payload supplied via returnUrl, then submits the signed value as redirect to any controller action that resolves the posted redirect URL. The sink renders the payload as an object template, executing embedded Twig and PHP.
No verified public proof-of-concept code is available. Refer to the GitHub Security Advisory GHSA-5jmw-g85v-7jv2 and the Vulncheck Advisory for Craft CMS for technical details.
Detection Methods for CVE-2026-92593
Indicators of Compromise
- POST requests to Craft CMS control panel controller endpoints containing a redirect parameter with a long base64-like HMAC prefix followed by Twig syntax such as {{ or {%.
- Unexpected outbound network connections, new PHP files under the web root, or shell processes spawned by the PHP-FPM or web server user.
- Control panel sessions from low-privilege editor accounts issuing requests to endpoints outside their normal editing workflow.
Detection Strategies
- Inspect web server and application logs for redirect or returnUrl values containing Twig delimiters ({{, }}, {%, %}) or PHP function names such as system, passthru, or exec.
- Correlate authenticated control panel requests that first fetch element edit pages calling elementLabelHtml() with subsequent POST requests carrying a signed redirect payload.
- Alert on new or modified PHP files under Craft's web/ directory and on unexpected child processes of the web server process tree.
Monitoring Recommendations
- Enable verbose logging for Craft CMS controller actions that call getPostedRedirectUrl() and forward the logs to a centralized analytics platform.
- Monitor for anomalous behavior from Craft CMS editor and author accounts, including off-hours activity and requests to unfamiliar endpoints.
- Baseline outbound network traffic from the Craft CMS host and alert on new destinations, DNS lookups, or reverse-shell traffic patterns.
How to Mitigate CVE-2026-92593
Immediate Actions Required
- Upgrade Craft CMS to version 5.10.13 or later on all instances running 5.10.0 through 5.10.12.
- Rotate the Craft securityKey after patching to invalidate any HMAC tokens an attacker may have minted before remediation.
- Audit control panel user accounts, disable unused editor accounts, and reset credentials for any account that could have been abused.
Patch Information
Craft CMS 5.10.13 fixes the incomplete sandbox on View::renderObjectTemplate() reached through Controller::getPostedRedirectUrl() and removes the self-signing oracle in Cp::elementLabelHtml(). See the GitHub Security Advisory GHSA-5jmw-g85v-7jv2 for release details.
Workarounds
- Restrict access to the Craft control panel using network-level controls such as IP allowlisting or a VPN until the patch is deployed.
- Temporarily revoke element edit permissions from non-essential accounts to reduce the population of users able to reach the signing oracle.
- Deploy a web application firewall rule that blocks POST requests to Craft controllers where the redirect parameter contains Twig delimiters.
# Configuration example: verify installed Craft CMS version and upgrade via Composer
php craft --version
composer require craftcms/cms:^5.10.13 --update-with-dependencies
php craft up
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
