In affected Craft CMS versions, environment variables and secrets are replaced in Twig templates during rendering, even when the Twig sandbox is enabled. The sandbox was intended to prevent remote code execution and unauthorized access to environment variables. However, the interpolation of environment variables via the elementId request parameter allows an authenticated attacker to leak secrets by rendering malicious sandboxed Twig templates. Although direct output of the secrets is not reflected in responses, attackers can use blind error-based methods to exfiltrate secrets over multiple requests. This flaw undermines the protection provided by the Twig sandbox and exposes critical environment secrets to authenticated control panel users.

An authenticated attacker with control panel access can steal arbitrary environment variables and secrets, including the CRAFT_SECURITY_KEY, database credentials, SMTP credentials, and API keys. This can lead to session forgery, privilege escalation, and unauthorized access to connected services. The vulnerability affects confidentiality of sensitive data but requires authenticated access with elevated privileges.

A patch is available for this vulnerability. Users should upgrade to Craft CMS versions 4.18.2 or later and 5.10.6 or later where this issue is fixed. Applying the official patch eliminates the environment variable interpolation flaw and restores the intended security of the Twig sandbox. No additional mitigations are required if the patch is applied.