Craft CMS includes the dataUrl() Twig function in its sandbox allowlist, which permits any control panel user with the utility:system-messages permission to embed file-reading payloads in system email templates. When emails are sent, the server reads the specified file and embeds its base64-encoded contents in the email body. The .env file, containing sensitive credentials and keys, bypasses existing protection checks and can be fully exfiltrated. Possession of the CRAFT_SECURITY_KEY enables attackers to forge session tokens, leading to full administrative account takeover. This vulnerability affects Craft CMS versions >=4.0.0-RC1 <4.18.0 and >=5.0.0-RC1 <5.10.0 and has been fixed in versions 4.18.0 and 5.10.0.

Sensitive information such as database passwords, security keys, and API keys stored in the .env file can be exfiltrated by an attacker with limited permissions (utility:system-messages). This exposure enables attackers to forge session tokens and escalate privileges to full administrator control over the CMS, potentially compromising the entire system.

A fix is available in Craft CMS versions 4.18.0 and 5.10.0. Users should upgrade to these or later versions to remediate this vulnerability. No other vendor advisory or patch information is provided, so patch status beyond these versions is not confirmed. Until upgraded, restrict the utility:system-messages permission to trusted users only.