CVE-2026-115938: CWE-1336 Improper neutralization of special elements used in a template engine in craftcms cms

Craft CMS allows authenticated control panel users to submit element-search conditions evaluated as sandboxed Twig templates. However, the allowed column filter delegates property lookup to Yii ArrayHelper outside Twig's SecurityPolicy, enabling repeated single-segment lookups to bypass sandbox restrictions. The vulnerability leaks the GeneralConfig::securityKey via a remote character oracle formed by JSON endpoint responses. With the recovered key, an attacker can compute Craft's generic HMAC wire format offline, allowing signed parameters to be accepted and passed to unsandboxed View::renderObjectTemplate(), where Twig's string-callable form can invoke native PHP callables. The proof-of-concept uses a harmless substr() callback and does not execute OS commands.

An authenticated control panel user can exploit this vulnerability to recover the application's security key, enabling them to forge signed parameters and potentially execute arbitrary PHP callables within unsandboxed template rendering. This could lead to unauthorized actions within the CMS environment. The CVSS 4.0 score is 8.7 (high severity), reflecting network attack vector, low attack complexity, no user interaction, and high impacts on confidentiality, integrity, and availability.

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated control panel user privileges to trusted personnel only and monitor for suspicious activity related to template rendering and signed parameter usage.