The vulnerability in Craft CMS involves the dataUrl() Twig function being included in the Twig sandbox allowlist for control panel users with the utility:system-messages permission. This allows such users to embed payloads in system email templates that read arbitrary files on the server and embed their contents as base64-encoded data URLs in outgoing emails. The .env file, which contains sensitive credentials and keys, can be fully exfiltrated despite existing protection checks. Obtaining the CRAFT_SECURITY_KEY enables attackers to forge session tokens and escalate privileges to full administrative control. The vulnerability affects versions starting from 4.0.0-RC1 up to but not including 4.18.0, and 5.0.0-RC1 up to but not including 5.10.0. The issue has been fixed in versions 4.18.0 and 5.10.0.

An attacker with the utility:system-messages permission can read arbitrary files on the server by embedding file-reading payloads in system email templates. This leads to exposure of sensitive information such as database passwords, security keys, and API keys stored in the .env file. With the CRAFT_SECURITY_KEY, an attacker can forge session tokens, resulting in full administrative account takeover. This elevates the risk from a limited permission user to a complete compromise of the CMS.

Upgrade Craft CMS to version 4.18.0 or later if using the 4.x branch, or to version 5.10.0 or later if using the 5.x branch. These versions contain the fix that removes the vulnerability. Until upgraded, restrict the utility:system-messages permission to trusted users only, as this permission enables exploitation of the vulnerability. Patch status is confirmed fixed in the specified versions.