https://vulnerability.circl.lu/sightings/feed 2026-07-17T00:42:55.998824+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/db2252d2-ba53-4900-b0d7-45a1e5b93a93/export 2026-07-17T00:42:56.007002+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "db2252d2-ba53-4900-b0d7-45a1e5b93a93", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-287w-mxq6-x2cp", "type": "seen", "source": "https://gist.github.com/alon710/42394c2aa3975303824ce1e33bac787e", "content": "# CVE-2026-55792: CVE-2026-55792: Sensitive File Disclosure in Craft CMS via Twig Sandbox Bypass\n\n> **CVSS Score:** 6.0\n> **Published:** 2026-07-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55792\n\n## Summary\nCVE-2026-55792 represents a sensitive file disclosure vulnerability in Craft CMS. The issue arises from the inclusion of the `dataUrl()` function in the Twig sandbox allowlist combined with incomplete path validation inside the underlying helper method. Attackers with low-privileged control panel access can exploit this flaw to read and exfiltrate the `.env` configuration file.\n\n## TL;DR\nLow-privileged users with template customizer access can read sensitive local files like `.env` using a sandbox bypass, leading to full database credential and security key compromise.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-200\n- **Attack Vector**: Network\n- **CVSS 4.0 Score**: 6.0\n- **EPSS Score**: 0.00268\n- **Impact**: Sensitive Information Disclosure / Local File Read\n- **Exploit Status**: PoC in technical advisories\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Craft CMS 4.x\n- Craft CMS 5.x\n- **Craft CMS**: >= 4.0.0-RC1, < 4.18.0 (Fixed in: `4.18.0`)\n- **Craft CMS**: >= 5.0.0-RC1, < 5.10.0 (Fixed in: `5.10.0`)\n\n## Mitigation\n\n- Upgrade Craft CMS to versions 4.18.0, 5.10.0, or newer.\n- Revoke the 'utility:system-messages' permission from non-administrative users.\n- Manually modify twig-sandbox.php config to strip the dataUrl function.\n\n**Remediation Steps:**\n1. Run 'composer update craftcms/cms' to pull the latest security release.\n2. Verify the installation of version 4.18.0+ or 5.10.0+.\n3. Inspect the database table 'systemmessages' for any unauthorized template injections containing 'dataUrl'.\n\n## References\n\n- [GitHub Security Advisory GHSA-287w-mxq6-x2cp](https://github.com/craftcms/cms/security/advisories/GHSA-287w-mxq6-x2cp)\n- [Craft CMS Pull Request 18559](https://github.com/craftcms/cms/pull/18559)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55792) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-06T21:42:10.999469Z"} 2026-07-06T21:42:10.999469+00:00