https://vulnerability.circl.lu/sightings/feed 2026-08-23T16:18:39.113676+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/638841bd-ce36-4a30-a3de-24eabc4a28b4/export 2026-08-23T16:18:39.120333+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "638841bd-ce36-4a30-a3de-24eabc4a28b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-596P-6JV8-775V", "type": "seen", "source": "https://gist.github.com/alon710/c7b44a1ea6b80e7066b89d9f2735b13f", "content": "# GHSA-596P-6JV8-775V: GHSA-596p-6jv8-775v: Authenticated Leak of Secret Environment Variables in Craft CMS\n\n> **CVSS Score:** 5.1\n> **Published:** 2026-08-06\n> **Full Report:** https://cvereports.com/reports/GHSA-596P-6JV8-775V\n\n## Summary\nAn authenticated information disclosure vulnerability in Craft CMS allows high-privilege administrators to extract sensitive environment variables, including the CRAFT_SECURITY_KEY and database credentials, using a blind error-based template injection attack within element select condition rules.\n\n## TL;DR\nAuthenticated users can exfiltrate sensitive environment variables by abusing sequential evaluation of environment parsing and sandboxed Twig templates.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-1336\n- **Attack Vector**: Network\n- **CVSS v4.0**: 5.1\n- **Impact**: Partial Information Disclosure\n- **Exploit Status**: Proof-of-Concept\n- **Privileges Required**: High (Admin Access)\n- **CISA KEV Status**: No\n\n## Affected Systems\n\n- Craft CMS 4.x systems prior to 4.18.2\n- Craft CMS 5.x systems prior to 5.10.6\n- **Craft CMS**: >= 4.0.0-RC1, <= 4.18.1 (Fixed in: `4.18.2`)\n- **Craft CMS**: >= 5.0.0-RC1, <= 5.10.5 (Fixed in: `5.10.6`)\n\n## Mitigation\n\n- Upgrade Craft CMS installations to 4.18.2 (for 4.x branch) or 5.10.6 (for 5.x branch).\n- Enforce strict IP restrictions and multi-factor authentication (MFA) on the Craft CMS Control Panel.\n- Scan application databases periodically for unauthorized Twig payloads stored in condition rules.\n\n**Remediation Steps:**\n1. Navigate to the root directory of the Craft CMS project.\n2. Execute the composer update command: 'composer update craftcms/cms' to fetch the patched version.\n3. Verify the installed package version using 'composer show craftcms/cms' to ensure it is at or above the designated patch versions.\n4. Run database and configuration audits to confirm no template-injection signatures reside in the system configurations.\n\n## References\n\n- [GitHub Security Advisory GHSA-596p-6jv8-775v](https://github.com/craftcms/cms/security/advisories/GHSA-596p-6jv8-775v)\n- [Craft CMS Core Repository](https://github.com/craftcms/cms)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-596P-6JV8-775V) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-07T00:33:31.334990Z"} 2026-08-07T00:33:31.334990+00:00