{"metadata": {"vulnerability": "CVE-2026-115938", "count": 10, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 5}}, "data": [{"timestamp": "2026-10-23T21:25:32.945Z", "date_only": false, "value": "2026-10-23T21:25:32.945Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-115938", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-23T21:58:51.816Z", "date_only": false, "value": "2026-10-23T21:58:51.816Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-115938", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-23T21:58:51.816Z", "date_only": false, "value": "2026-10-23T21:58:51.816Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-115938", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-23T21:58:51.816Z", "date_only": false, "value": "2026-10-23T21:58:51.816Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Hackrate", "record": "CVE-2026-115938", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-23T22:01:23.295Z", "date_only": false, "value": "2026-10-23T22:01:23.295414Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117492474368496846", "record": "CVE-2026-115938", "field": "creation_timestamp", "uuid": "ca2482ac-b7c8-4086-85e2-aa2f2c8c4ae1", "content": "CVE-2026-115938 Low privilege condition filter escapes Twig sandbox, recovers \"securityKey\" and reaches RCE Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft\u2019s allowed column filter delegates property lookup to Yii ArrayHelper, outside Twig\u2019s SecurityPolicy. Repeated single-segment lookups therefore bypass the sandbox\u2019s empty property/method allowlists.\nThe vulnerable condition value is ultimately cast to an integer. That does not protect the secret: the template can return author ID 1 when a guessed key character is correct and an impossible ID otherwise. The JSON endpoint returns entries for the first case and an empty array for the second, forming a stable remote character oracle.\nAfter recovering GeneralConfig::securityKey, the same user can compute Craft\u2019s generic HMAC wire format offline. Signed parameters such as redirect are then accepted and passed to unsandboxed View::renderObjectTemplate(), where Twig\u2019s string-callable form can invoke native PHP callables. The regression proof uses the harmless substr() callback and observes abcdef becoming cdef; it does not execute an OS command.\nhttps://www.cve.org/CVERecord?id=CVE-2026-115938https://www.hckrt.com/hacktivity/HCKRT-DRNL9Whttps://github.com/craftcms/cms/releases/tag/5.11.2https://github.com/craftcms/cmshttps://github.com/craftcms/cms/security/advisories/GHSA-v4q3-2g5g-wjj6#craftcms #cms#CVE_2026_115938#bot", "url": "https://infosec.exchange/users/cve/statuses/117492474368496846"}, {"timestamp": "2026-10-23T22:16:59Z", "date_only": false, "value": "2026-10-23T22:16:59Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-GG4P-9C93-5HFP", "record": "GHSA-GG4P-9C93-5HFP", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-23T22:16:59.597Z", "date_only": false, "value": "2026-10-23T22:16:59.597", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-115938", "record": "FKIE_CVE-2026-115938", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-24T00:32:35Z", "date_only": false, "value": "2026-10-24T00:32:35Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-GG4P-9C93-5HFP", "record": "GHSA-GG4P-9C93-5HFP", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-24T00:32:35Z", "date_only": false, "value": "2026-10-24T00:32:35Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-GG4P-9C93-5HFP", "record": "GHSA-GG4P-9C93-5HFP", "field": "modified"}, {"timestamp": "2026-10-26T18:34:17.050Z", "date_only": false, "value": "2026-10-26T18:34:17.050", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-115938", "record": "FKIE_CVE-2026-115938", "field": "lastModified"}], "metrics": {"as_of": "2026-10-29T17:36:29.399Z", "anchors": {"origin": {"timestamp": "2026-10-23T21:58:51.816Z", "date_only": false, "value": "2026-10-23T21:58:51.816Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-115938", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-23T21:58:51.816Z", "date_only": false, "value": "2026-10-23T21:58:51.816Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-115938", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 502657.583657, "hours": 139.62710657138888, "days": 5.817796107141204, "min_seconds": 502657.583657, "max_seconds": 502657.583657, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-23T21:58:51.816Z", "date_only": false, "value": "2026-10-23T21:58:51.816Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-115938", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-29T17:36:29.399Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}