CVE-2026-115938 is a high-severity vulnerability in Craft CMS affecting versions 4.0.0 up to but not including 4.18.9, and 5.0.0 up to but not including 5.11.2. It involves improper neutralization of special elements in the template engine, allowing authenticated control panel users to exploit a sandbox bypass in Twig templates. This leads to leakage of the GeneralConfig::securityKey and enables offline computation of HMAC signatures, which can then be used to pass signed parameters to unsandboxed template rendering, potentially invoking native PHP callables.
CVE-2026-115937 is a high-severity vulnerability in the Craft CMS commerce-mollie plugin where the Mollie webhook endpoint fails to verify the association between two attacker-controlled parameters: commerceTransactionHash and id. This flaw allows an unauthenticated attacker with any paid Mollie payment ID from the merchant's account to mark arbitrary transactions as paid, regardless of the actual payment amount.
CVE-2026-115935 is a high-severity code injection vulnerability in CraftCMS that allows authenticated non-admin users with control panel access to inject a new security key into the .env file via crafted API response headers. This enables the attacker to forge signed login redirects containing Twig system() callbacks, potentially leading to remote code execution. The vulnerability affects CraftCMS versions 4.0.0 up to but not including 4.18.9, and 5.0.0 up to but not including 5.11.2.
Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its class-name checks are case-sensitive while PHP class resolution is not. Attackers with template-execution rights, such as Control Panel administrators, can instantiate SplFileObject via a lowercase class name to read .env secrets or write a PHP file into the webroot for remote code execution.
Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite() is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete entries, categories, tags, and assets shared across sites.
Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate them for active users. Attackers who obtain a victim's emailed code can submit it to users/set-password after the victim verifies an email change, resetting the password and taking over the account.
Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to inject Yii behaviors by supplying a JSON-string field layout to ContentBlock::setFieldLayout(). Attackers with allowAdminChanges enabled can include 'as X' or 'on X' keys that bypass cleanseConfig() to execute OS commands as the web user and disclose secrets.
Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by passing uncleansed criteria to getNext, getPrev, or getOwners. Attackers can inject Yii "as" or "on" config keys to attach malicious event handlers that execute when the element query runs, achieving code execution as the web user.
Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox via Asset::getMimeType transforms. Attackers can supply 'as' or 'on' keys passed unfiltered to Craft::createObject, attaching malicious behaviors or event handlers that execute code as the web user.
Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contains a Twig sandbox allowlist bypass because the column, contains, filterByValue, index, where, and multisort filters resolve caller-supplied keys via ArrayHelper::getValue() without consulting the sandbox security policy. Authenticated Control Panel users can supply dot-path keys to traverse the craft global and disclose the securityKey, database credentials, and auth tokens.
Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in the Twig group filter, which invokes non-string arrow arguments as callables without the checkArrow guard used by other arrow-accepting filters. Authenticated control panel users can pass an array-callable such as FileHelper::writeToFile via element-select condition rules to write a webshell to the webroot and execute code as the web user.
Craft CMS versions 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 contain a code injection vulnerability in the AppController::actionCacheUpdates method. This flaw allows authenticated control panel users with specific permissions to inject arbitrary code by manipulating the 'updates' request parameter without proper cleansing. The vulnerability enables execution of behavior and event-handler injection via crafted 'as' or 'on' keys.
Craft CMS versions 5.0.0 through before 5.10.14 contain a DOM-based cross-site scripting (XSS) vulnerability in the control panel login and two-factor authentication (2FA) verification flow. The vulnerability arises because a user-controlled returnUrl parameter accepts javascript: URLs, which are used in client-side navigation. An attacker can exploit this by tricking a 2FA-enabled user into opening a crafted URL during the login process, resulting in JavaScript execution within the authenticated control panel session.
Craft CMS versions from 5.0.0 up to but not including 5.10.14 have a missing authorization vulnerability in the AppController::actionSwitchToLicensedEdition() function. This flaw allows any authenticated user, including low-privileged front-end users, to change the installed edition of the CMS. Exploitation can cause a persistent downgrade of the site edition in the project configuration, which administrators cannot reverse through the control panel.
Craft CMS versions from 5.10.2 up to but not including 5.10.14 contain a vulnerability in the Twig sandbox that allows non-admin users with System Messages permission to execute arbitrary PHP code via specially crafted templates. This occurs through a sandbox bypass involving the 'has some' and 'has every' operators, enabling invocation of PHP callables such as passthru or system. The vulnerability has a high severity with a CVSS 4.0 score of 8.7.
Craft CMS versions 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 have an arbitrary file read vulnerability. This occurs because the Twig create() class blocklist does not include DOMDocument, allowing attackers with certain privileges to read local files. Specifically, attackers able to set an entry-type title format, including via project-config/apply, can exploit this to expose local file contents to non-admin users who can view entries.
Craft CMS versions 5.0.0 up to but not including 5.11.0 contain an authenticated remote code execution vulnerability in the Control Panel action app/render-components. Any authenticated user with basic Control Panel access can exploit this flaw by submitting specially crafted component classes and property overrides, leading to arbitrary Twig template code execution. This vulnerability allows execution of PHP functions such as system(), resulting in operating system command execution with the privileges of the web server process. The issue does not require admin privileges or access to sensitive settings or files.
Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the GraphQL draftCreator and revisionCreator fields: instead of requiring the user-data scope enforced by Gql::canQueryUsers() (usergroups.*:read), these fields are gated only on the elements.drafts:read / elements.revisions:read scopes, and their resolver returns a raw User element whose email, username, fullName, and addresses fields have no per-field authorization. A client holding only the drafts or revisions scope — including an unauthenticated client when the operator has enabled the public GraphQL schema with those scopes — can therefore harvest the email addresses, usernames, full names, and postal addresses of all draft/revision creators (typically site editors and administrators). The issue is fixed in 5.11.0.
Craft CMS versions 5.10.0 through 5.10.12 contain a vulnerability allowing authenticated low-privilege control panel users with edit rights on a single element type to execute arbitrary PHP code via server-side template injection. This occurs due to an incomplete fix for a previous vulnerability, where the unsandboxed sink in the code remained exploitable. The issue is resolved in version 5.10.13.
Craft CMS versions 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 contain a vulnerability where an authenticated non-administrator user can execute arbitrary operating system commands. This occurs due to improper binding of HMAC signatures to their purpose, allowing an attacker to reuse a signed cookie in a redirect parameter that is rendered as an unsandboxed Twig template. The issue requires password authentication without 2FA and availability of PHP system(). The vulnerability is fixed in versions 4.18.6 and 5.10.13.