{"uuid": "c1ccb68b-bd66-4a49-9ea4-24d867ca2039", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55792", "type": "seen", "source": "https://gist.github.com/alon710/42394c2aa3975303824ce1e33bac787e", "content": "# CVE-2026-55792: CVE-2026-55792: Sensitive File Disclosure in Craft CMS via Twig Sandbox Bypass\n\n> **CVSS Score:** 6.0\n> **Published:** 2026-07-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55792\n\n## Summary\nCVE-2026-55792 represents a sensitive file disclosure vulnerability in Craft CMS. The issue arises from the inclusion of the `dataUrl()` function in the Twig sandbox allowlist combined with incomplete path validation inside the underlying helper method. Attackers with low-privileged control panel access can exploit this flaw to read and exfiltrate the `.env` configuration file.\n\n## TL;DR\nLow-privileged users with template customizer access can read sensitive local files like `.env` using a sandbox bypass, leading to full database credential and security key compromise.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-200\n- **Attack Vector**: Network\n- **CVSS 4.0 Score**: 6.0\n- **EPSS Score**: 0.00268\n- **Impact**: Sensitive Information Disclosure / Local File Read\n- **Exploit Status**: PoC in technical advisories\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Craft CMS 4.x\n- Craft CMS 5.x\n- **Craft CMS**: >= 4.0.0-RC1, < 4.18.0 (Fixed in: `4.18.0`)\n- **Craft CMS**: >= 5.0.0-RC1, < 5.10.0 (Fixed in: `5.10.0`)\n\n## Mitigation\n\n- Upgrade Craft CMS to versions 4.18.0, 5.10.0, or newer.\n- Revoke the 'utility:system-messages' permission from non-administrative users.\n- Manually modify twig-sandbox.php config to strip the dataUrl function.\n\n**Remediation Steps:**\n1. Run 'composer update craftcms/cms' to pull the latest security release.\n2. Verify the installation of version 4.18.0+ or 5.10.0+.\n3. Inspect the database table 'systemmessages' for any unauthorized template injections containing 'dataUrl'.\n\n## References\n\n- [GitHub Security Advisory GHSA-287w-mxq6-x2cp](https://github.com/craftcms/cms/security/advisories/GHSA-287w-mxq6-x2cp)\n- [Craft CMS Pull Request 18559](https://github.com/craftcms/cms/pull/18559)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55792) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-06T21:42:10.955204Z"}