Craft CMS suffers from an authenticated information disclosure vulnerability (CVE-2026-31857) where environment variables and secrets are interpolated into Twig templates even when the sandbox is enabled. The parameter 'elementId' allows environment variable references in the form ${ENV_VAR} to be replaced with their values before the template is rendered. Although sandboxed Twig templates restrict direct access to environment variables and network functions, this interpolation bypasses those restrictions. An attacker with control panel access can use blind error-based techniques to incrementally leak secrets such as the CRAFT_SECURITY_KEY, database credentials, and API keys. This vulnerability enables session forgery, privilege escalation, and credential theft. The vulnerability is rated moderate severity and a patch is available.

An authenticated attacker with control panel access can leak arbitrary environment variables and secrets by abusing the interpolation mechanism in Twig templates. This can lead to session forgery, privilege escalation, and theft of sensitive credentials including database, SMTP, and API keys. The attack requires many requests and blind error-based extraction techniques. The vulnerability undermines the security guarantees of the Twig sandbox and can compromise the confidentiality and integrity of the Craft CMS environment.

A patch is available for this vulnerability. Users should apply the official fix provided by the Craft CMS vendor to prevent environment variable leakage via Twig template interpolation. Until patched, restricting control panel access and monitoring for suspicious template rendering activity may reduce risk. Verify that the Twig sandbox is enabled and updated to the fixed version. Check the vendor advisory for the latest remediation guidance.