{"id":"CVE-2026-72782","revision":"54a3e4f79acc4bb08b975da0e423a886","records":[{"revision":"54a3e4f79acc4bb08b975da0e423a886","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-72782","aliases":[],"title":"Craft CMS 5.0.0-RC1 before 5.10.6 Environment Variable Leak","description":"Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 interpolate environment variables and secrets (via ${ENV_VAR} strings in the elementId parameter) into Twig templates before rendering, even when the Twig sandbox is enabled. An authenticated attacker with control panel access can render a malicious sandboxed Twig template and, using a blind error-based technique across many requests, incrementally leak arbitrary environment variables and secrets. These can be abused to forge sessions (via CRAFT_SECURITY_KEY), escalate privileges, and steal database, SMTP, API, or blob storage credentials. Fixed in 5.10.6 and 4.18.2.","state":0,"publishedAt":"2026-08-11T12:17:17.101+00:00","modifiedAt":"2026-10-08T15:24:28.239+00:00","affected":[{"ecosystem":"Vendor product","name":"cms","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"craftcms\",\n                    \"product\": \"cms\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"5.0.0-RC1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"5.10.6\"\n                        },\n                        {\n                            \"version\": \"5.10.6\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"packageURL\": \"pkg:composer/craftcms/cms\"\n                }"},{"ecosystem":"Vendor product","name":"cms","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"craftcms\",\n                    \"product\": \"cms\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"4.0.0-RC1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"4.18.2\"\n                        },\n                        {\n                            \"version\": \"4.18.2\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"packageURL\": \"pkg:composer/craftcms/cms\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":7.1,"severity":"HIGH"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5,"severity":"MEDIUM"}],"references":["https://github.com/craftcms/cms/security/advisories/GHSA-596p-6jv8-775v","https://www.vulncheck.com/advisories/craft-cms-rc1-before-environment-variable-leak"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-72782","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-72782","identifiers":["CVE-2026-72782"]},"retained":false,"historicalAffected":[]}],"coverage":[]}