CVE-2026-115935 craftcms CVE debrief

Who should care

Defenders responsible for Craft CMS deployments should assess exposure and verify authentication and authorization controls. This includes reviewing the current configuration and ensuring that only authorized users have access to the control panel. Additionally, defenders should monitor for potential exploitation attempts and review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

Defenders should prioritize verification of affected systems and review authentication and authorization controls due to potential Twig system() callback execution and elevation of privileges via fake API response headers.

• Potential execution of arbitrary system commands via Twig system() callback
• Potential elevation of privileges via fake API response headers
• Potential bypass of authentication and authorization controls

Technical summary

The app/process-api-response-headers action in Craft CMS accepts fake Craft API response headers from any authenticated control panel user, allowing for potential Twig system() callback execution. This issue enables a non-admin user with accessCp to place newline characters in X-Craft-Plugin-Licenses, which Craft passes to its .env writer without removing the newlines. This allows the user to insert a new attacker-known CRAFT_SECURITY_KEY into .env. After Craft loads that key, the user can forge a signed login redirect containing a Twig system() callback. The vulnerability arises from insufficient validation and sanitization of user-input data in the affected action.

Defensive priority

Defenders should prioritize verification of affected systems and review authentication and authorization controls.

Recommended defensive actions

• Verify affected systems and review authentication and authorization controls
• Review and update Craft CMS to the latest version
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record indicates that the app/process-api-response-headers action in Craft CMS accepts fake Craft API response headers from any authenticated control panel user, allowing for potential Twig system() callback execution. The issue arises from the lack of proper validation and sanitization of user-input data in the affected action. This vulnerability can be exploited by a non-admin user with accessCp, who can place newline characters in X-Craft-Plugin-Licenses. Craft passes this value to its .env writer without removing the newl`

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.