Craft CMS versions >=5.0.0-RC1 <5.10.6 and >=4.0.0-RC1 <4.18.2 improperly interpolate environment variables and secrets via the elementId parameter in Twig templates, even when the Twig sandbox is enabled. An authenticated attacker with control panel access can render malicious sandboxed Twig templates and use a blind error-based technique over multiple requests to leak arbitrary environment variables and secrets. These leaked secrets can be exploited to forge sessions (via CRAFT_SECURITY_KEY), escalate privileges, and steal sensitive credentials including database, SMTP, API, or blob storage credentials. The vulnerability is addressed in versions 5.10.6 and 4.18.2.

An attacker with authenticated control panel access can incrementally leak sensitive environment variables and secrets, potentially allowing session forgery, privilege escalation, and theft of critical credentials. This compromises the confidentiality and integrity of the affected system and its data.

Fixed versions 5.10.6 and 4.18.2 are available. Users should upgrade to at least these versions to remediate the vulnerability. No vendor advisory content is provided to indicate alternative mitigations or temporary fixes. Patch status is confirmed by the description stating the issue is fixed in these versions.