CVE-2026-115938 craftcms CVE debrief

Who should care

Administrators and users of Craft CMS instances, particularly those with authentication and authorization controls in place, should review and update their security controls to prevent exploitation of this vulnerability. They should also monitor for suspicious activity on Craft CMS instances and implement additional security measures for element-search conditions.

Why it matters

CVE-2026-115938 is a high-severity vulnerability in Craft CMS that allows authenticated control panel users to submit malicious element-search conditions, potentially leading to security key recovery and code execution. Defenders should prioritize reviewing and updating authentication and authorization controls, implementing additional security measures for element-search conditions, and monitoring for suspicious activity on Craft CMS instances.

• Potential security key recovery
• Possible code execution through unsandboxed View::renderObjectTemplate()
• Bypass of Twig's SecurityPolicy
• Elevation of privileges for authenticated control panel users

Technical summary

The vulnerability allows authenticated control panel users to submit malicious element-search conditions, potentially leading to security key recovery and code execution. The allowed column filter in Craft CMS delegates property lookup to Yii ArrayHelper outside Twig's SecurityPolicy, allowing repeated single-segment lookups to bypass the sandbox's empty property/method allowlists. The JSON endpoint returns entries for the first case and an empty array for the second, forming a stable remote character oracle. After recovering GeneralConfig::securityKey, the same user can compute Craft's generic HMAC wire format offline. Signed parameters such as redirect are then accepted and passed to unsandboxed View::render

Defensive priority

High priority for authentication and authorization controls

Recommended defensive actions

• Review and update authentication and authorization controls
• Implement additional security measures for element-search conditions
• Monitor for suspicious activity on Craft CMS instances
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability is caused by the allowed column filter in Craft CMS, which delegates property lookup to Yii ArrayHelper outside Twig's SecurityPolicy. This allows repeated single-segment lookups to bypass the sandbox's empty property/method allowlists. The JSON endpoint returns entries for the first case and an empty array for the second, forming a stable remote character oracle.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.