Sandbox Bypass Vulnerability in Craft CMS
CVE-2026-115938

8.7HIGH

Key Information:

Vendor

Craftcms

Status
Cms
Vendor
CVE Published:
23 October 2026

What is CVE-2026-115938?

Craft CMS contains a vulnerability that permits authenticated control panel users to exploit element-search conditions evaluated as sandboxed Twig templates. The misuse of Craft's column filter through Yii ArrayHelper enables circumvention of Twig’s SecurityPolicy, allowing attackers to perform unauthorized property lookups. This flaw transforms sensitive input into integers but does not effectively shield the underlying data. Attackers can probe for secret values, such as GeneralConfig::securityKey, via a stable remote oracle, enabling them to craft malicious HMAC signatures. Though the initial exploit may not execute OS commands, it opens avenues for broader attacks by invoking native PHP functionalities through Twig.

Affected Version(s)

cms 5.0.0 < 5.11.2

cms 4.0.0 < 4.18.9

References

https://www.hckrt.com/hacktivity/HCKRT-DRNL9W
third-party-advisorytechnical-descriptionmitigation
https://github.com/craftcms/cms/releases/tag/5.11.2
release-notes
https://github.com/craftcms/cms
product

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mohamed Wagdy (@Kalawy)
Hackrate
.