Craft CMS: Remote code execution via injected security key
Summary
Craft CMS 4.x before 4.18.9 and 5.x before 5.11.2 accept fake Craft API response headers from any control panel user with the accessCp permission. Newline characters in the X-Craft-Plugin-Licenses header are written unfiltered into the .env file, so the user can set a new CRAFT_SECURITY_KEY. With that key, the attacker can forge a signed login redirect that executes operating system commands on the server. Exploitation requires a valid control panel account with accessCp and no user interaction.
Affected
- Craft CMS 5.0.0 to before 5.11.2
- Craft CMS 4.0.0 to before 4.18.9
Fixed in
- Craft CMS 5.11.2
- Craft CMS 4.18.9
Workaround
Unknown.
Exploitation
- No public exploit code confirmed in the sources reviewed.
- Not known to be exploited in the wild in the sources reviewed.
Our recommendation
- Update Craft CMS to 5.11.2 or 4.18.9 or later.
- Review which accounts hold accessCp and remove it where it is not needed.
- Restrict control panel access by VPN or IP allowlist where possible.
- Check the .env file for unexpected changes to CRAFT_SECURITY_KEY. If you find one, rotate the key, which invalidates existing sessions.
- Apply the fix for the earlier sandbox bypass report separately, as the fixes do not cover each other.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-9hp6-3565-gvh5 github.com
- Craft CMS release 5.11.2 github.com
- HCKRT bug bounty report HCKRT-WM3VSE www.hckrt.com
- Craft CMS repository github.com
- VulDB entry CVE-2026-115935 vuldb.com
- Strix CVE-2026-115935 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:22.
Original description (NVD)
The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user. A non-admin user with only accessCp can place newline characters in X-Craft-Plugin-Licenses. Craft passes this value to its .env writer without removing the newlines. This lets the user insert a new attacker-known CRAFT_SECURITY_KEY into .env. After Craft loads that key, the user can forge a signed login redirect containing a Twig system() callback. This is different from the previous report. That report reads the existing key through a Twig sandbox bypass. This report replaces the key through fake API headers and CRLF injection. Fixing either source does not fix the other.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.