CVE-2026-92591 craftcms CVE debrief

Who should care

Defenders responsible for Craft CMS installations, security teams, and IT personnel should assess exposure and prioritize remediation. This includes reviewing the current version of Craft CMS, checking database configuration, and planning for upgrades or mitigations. Security teams should also monitor for potential exploitation attempts and review compensating controls for exposed systems.

Why it matters

CVE-2026-92591 is a high-severity vulnerability in Craft CMS that allows environment secret exposure via the installer. Defenders should prioritize verifying exposure and remediating vulnerable installations to prevent potential disclosure of sensitive information.

• Disclosure of sensitive information such as security keys, database credentials, or API keys
• Potential for lateral movement or further exploitation
• Need for verification of exposure and remediation of vulnerable installations
• Possible impact on compliance and regulatory requirements

Technical summary

The Craft CMS vulnerability allows environment secret exposure via the installer when a database outage occurs. An unauthenticated attacker can submit a predictable variable name and receive its value, disclosing Craft secrets, process environment variables, $_SERVER entries, or PHP constants. The issue requires an independently occurring database outage; the vulnerability itself provides no way to induce it. Fixed in 5.10.13. The vulnerability is a high-severity issue that can lead to disclosure of sensitive information.

Defensive priority

Defenders should prioritize verifying exposure and remediating vulnerable Craft CMS installations.

Recommended defensive actions

• Verify exposure by checking Craft CMS version and database configuration
• Remediate vulnerable installations by upgrading to version 5.10.13 or later
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, which requires a database outage to be exploited. The vendor has released a fix in version 5.10.13. The vulnerability allows environment secret exposure via the installer. The issue requires an independently occurring database outage; the vulnerability itself provides no way to induce it.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.