{"schema":"threatline.record/2","record":{"id":"GHSA-9hp6-3565-gvh5","aliases":["GHSA-9hp6-3565-gvh5"],"summary":"Control panel only API response emulation replaces \"securityKey\" and reaches server RCE","details":"The `app/process-api-response-headers` action accepts fake Craft API response headers from any authenticated control panel user.\r\n\r\nA non-admin user with only `accessCp` can place newline characters in `X-Craft-Plugin-Licenses`. Craft passes this value to its `.env` writer without removing the newlines.\r\n\r\nThis lets the user insert a new attacker-known `CRAFT_SECURITY_KEY` into `.env`. After Craft loads that key, the user can forge a signed login redirect containing a Twig `system()` callback.\r\n\r\nThis is different from the previous report. That report reads the existing key through a Twig sandbox bypass. This report replaces the key through fake API headers and CRLF injection. Fixing either source does not fix the other.\r\n\r\n### Impact\r\n\r\nA low-privileged control panel account can execute arbitrary operating system commands as the PHP worker.\r\n\r\nReport ID: 1899","categories":["Unclassified"],"product":"craftcms/cms","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/craftcms/cms/security/advisories/GHSA-9hp6-3565-gvh5","source_modified_at":"2026-10-23T08:51:12Z","fetched_at":"2026-10-25T16:01:37.004770Z","package":{"ecosystem":"composer","name":"craftcms/cms"},"range":">= 4.0.0, < 4.18.9"},{"source":"GitHub Advisory Database","source_url":"https://github.com/craftcms/cms/security/advisories/GHSA-9hp6-3565-gvh5","source_modified_at":"2026-10-23T08:51:12Z","fetched_at":"2026-10-25T16:01:37.004770Z","package":{"ecosystem":"composer","name":"craftcms/cms"},"range":">= 5.0.0, < 5.11.2"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/craftcms/cms/security/advisories/GHSA-9hp6-3565-gvh5","source_modified_at":"2026-10-23T08:51:12Z","fetched_at":"2026-10-25T16:01:37.004770Z","package":{"ecosystem":"composer","name":"craftcms/cms"},"version":"4.18.9"},{"source":"GitHub Advisory Database","source_url":"https://github.com/craftcms/cms/security/advisories/GHSA-9hp6-3565-gvh5","source_modified_at":"2026-10-23T08:51:12Z","fetched_at":"2026-10-25T16:01:37.004770Z","package":{"ecosystem":"composer","name":"craftcms/cms"},"version":"5.11.2"}],"cvss":null,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-23T08:51:12Z","modified_at":"2026-10-23T08:51:12Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/craftcms/cms/security/advisories/GHSA-9hp6-3565-gvh5","fetched_at":"2026-10-25T16:01:37.004770Z","source_modified_at":"2026-10-23T08:51:12Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-23T08:51:12Z","content_hash":"c5d78d99a5503c2f3042c703fa88e9de3ba2effabc0fe76cd85914418c3cd14a"}}