This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2026-124430 | BDVDB-2026-401986 Detail

craftcmscms

Description#

Craft CMS from 5.10.0 before 5.11.2 contains a remote code execution vulnerability that allows non-administrator control panel users to obtain HMAC-signed Twig templates via the app/render-elements endpoint. Attackers can submit the signed templated returnUrl as the login redirect parameter, triggering unsandboxed renderObjectTemplate() evaluation and executing OS commands as the PHP worker.

Impact#

Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact high. Attack vector: network.

Weaknesses#

  • CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine

References#

Exploit#

No public exploit known

History#

  1. Version 1Record published in the CVE List.