CVE-2026-115935: CWE-94 Improper Control of Generation of Code ('Code Injection') in craftcms cms

The vulnerability arises from the app/process-api-response-headers action in CraftCMS, which accepts fake API response headers from any authenticated control panel user. A non-admin user with accessCp permission can insert newline characters into the X-Craft-Plugin-Licenses header. CraftCMS passes this header value to its .env writer without sanitizing newlines, allowing the attacker to inject a new CRAFT_SECURITY_KEY into the .env file. Once the key is loaded, the attacker can forge signed login redirects containing Twig system() callbacks, enabling code injection. This issue is distinct from a previous report that involved reading the existing key via a Twig sandbox bypass; this one replaces the key via CRLF injection in API headers. Fixing one does not mitigate the other.

An authenticated non-admin user with control panel access can inject a new security key into the .env file, enabling them to forge signed login redirects with arbitrary Twig system() callbacks. This can lead to remote code execution within the context of the CraftCMS application, posing a significant security risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict control panel access to trusted users only and monitor for unusual activity related to API response headers. Avoid granting accessCp permission to untrusted users. Follow vendor updates closely for an official fix.