CVE-2026-72782 Craft CMS 5.0.0-RC1 before 5.10.6 Environment Variable Leak
Authenticated attackers can leak environment variables and secrets via Twig template interpolation, enabling session forgery and credential theft.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72782?
CVE-2026-72782 is a high-severity vulnerability in craftcms cms, published on 11 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 interpolate environment variables and secrets (via ${ENV_VAR} strings in the elementId parameter) into Twig templates before rendering, even when the Twig sandbox is enabled. An authenticated attacker with control panel access can render a malicious sandboxed Twig template and, using a blind error-based technique across many requests, incrementally leak arbitrary environment variables and secrets. These can be abused to forge sessions (via CRAFT_SECURITY_KEY), escalate privileges, and steal database, SMTP, API, or blob storage credentials. Fixed in 5.10.6 and 4.18.2.
Weakness: CWE-668
Which versions are affected by CVE-2026-72782?
4 open source packages ship an affected version, including craftcms/cms.
| Package | Affected | Fixed in |
|---|---|---|
craftcms/cms Packagist | From 4.0.0-RC1 | 4.18.2 |
craftcms/cms Packagist | From 4.0.0-RC1 | 4.18.2 |
craftcms/cms Packagist | From 5.0.0-RC1 | 5.10.6 |
craftcms/cms Packagist | From 5.0.0-RC1 | 5.10.6 |
How do I fix CVE-2026-72782?
Upgrade craftcms/cms to a fixed version for your release line: 4.18.2 or 5.10.6.
Is CVE-2026-72782 being exploited?
There is no known exploitation of CVE-2026-72782 in the wild and no public exploit code.
Sources
Also known as GHSA-596p-6jv8-775v.