{"schema":"threatline.record/2","record":{"id":"CVE-2026-115938","aliases":["GHSA-v4q3-2g5g-wjj6"],"summary":"Low privilege condition filter escapes Twig sandbox, recovers \"securityKey\" and reaches RCE","details":"Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed column filter delegates property lookup to Yii ArrayHelper, outside Twig’s SecurityPolicy. Repeated single-segment lookups therefore bypass the sandbox’s empty property/method allowlists.\n\n\n\nThe vulnerable condition value is ultimately cast to an integer. That does not protect the secret: the template can return author ID 1 when a guessed key character is correct and an impossible ID otherwise. The JSON endpoint returns entries for the first case and an empty array for the second, forming a stable remote character oracle.\n\n\n\nAfter recovering GeneralConfig::securityKey, the same user can compute Craft’s generic HMAC wire format offline. Signed parameters such as redirect are then accepted and passed to unsandboxed View::renderObjectTemplate(), where Twig’s string-callable form can invoke native PHP callables. The regression proof uses the harmless substr() callback and observes abcdef becoming cdef; it does not execute an OS command.","categories":["Unclassified"],"product":"cms","vendor":"craftcms","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115938","source_modified_at":"2026-10-23T21:58:51.816Z","fetched_at":"2026-10-23T22:01:05.715934Z","product":"cms","vendor":"craftcms","versions":[{"status":"affected","version":"5.0.0","lessThan":"5.11.2","versionType":"semver"},{"status":"affected","version":"4.0.0","lessThan":"4.18.9","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115938","source_modified_at":"2026-10-23T21:58:51.816Z","fetched_at":"2026-10-23T22:01:05.715934Z","package":{"name":"cms","ecosystem":null},"version":"5.11.2","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115938","source_modified_at":"2026-10-23T21:58:51.816Z","fetched_at":"2026-10-23T22:01:05.715934Z","package":{"name":"cms","ecosystem":null},"version":"4.18.9","basis":"first unaffected version stated in the CVE record"}],"cvss":8.7,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-23T21:58:51.816Z","modified_at":"2026-10-23T21:58:51.816Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-115938","fetched_at":"2026-10-23T22:01:05.715934Z","source_modified_at":"2026-10-23T21:58:51.816Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://www.hckrt.com/hacktivity/HCKRT-DRNL9W","tags":["third-party-advisory","technical-description","mitigation"]},{"source":"CVE List","url":"https://github.com/craftcms/cms/releases/tag/5.11.2","tags":["release-notes"]},{"source":"CVE List","url":"https://github.com/craftcms/cms","tags":["product"]},{"source":"CVE List","url":"https://github.com/craftcms/cms/security/advisories/GHSA-v4q3-2g5g-wjj6","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-23T21:58:51.816Z","content_hash":"4613ebb716fec61add16426b95cd42be7d97827c65148fdc3fd120c159c84e9a"}}