All vulnerabilities
GHSA-9hp6-3565-gvh5

craftcms/cms: Control panel only API response emulation replaces "securityKey" and reaches server RCE

craftcms/cms
Open in ThreatlineRecord JSON
CVSS
n/aHigh
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in4.18.9Also 5.11.2GitHub
Published23 Oct 2026Updated 23 Oct 2026GitHub

What fixes it

  • 4.18.9craftcms/cms, composerGitHubcomposer require "craftcms/cms:^4.18.9"
  • 5.11.2craftcms/cms, composerGitHubcomposer require "craftcms/cms:^5.11.2"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user.

A non-admin user with only accessCp can place newline characters in X-Craft-Plugin-Licenses. Craft passes this value to its .env writer without removing the newlines.

This lets the user insert a new attacker-known CRAFT_SECURITY_KEY into .env. After Craft loads that key, the user can forge a signed login redirect containing a Twig system() callback.

This is different from the previous report. That report reads the existing key through a Twig sandbox bypass. This report replaces the key through fake API headers and CRLF injection. Fixing either source does not fix the other.

Impact

A low-privileged control panel account can execute arbitrary operating system commands as the PHP worker.

Report ID: 1899

Text from GitHub Advisory Database

Affected versions 2

  • craftcms/cms, composer>= 4.0.0, < 4.18.9GitHub
  • craftcms/cms, composer>= 5.0.0, < 5.11.2GitHub