https://vulnerability.circl.lu/sightings/feed 2026-07-11T19:03:05.416612+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/c1ccb68b-bd66-4a49-9ea4-24d867ca2039/export 2026-07-11T19:03:05.439326+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "c1ccb68b-bd66-4a49-9ea4-24d867ca2039", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55792", "type": "seen", "source": "https://gist.github.com/alon710/42394c2aa3975303824ce1e33bac787e", "content": "# CVE-2026-55792: CVE-2026-55792: Sensitive File Disclosure in Craft CMS via Twig Sandbox Bypass\n\n> **CVSS Score:** 6.0\n> **Published:** 2026-07-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55792\n\n## Summary\nCVE-2026-55792 represents a sensitive file disclosure vulnerability in Craft CMS. The issue arises from the inclusion of the `dataUrl()` function in the Twig sandbox allowlist combined with incomplete path validation inside the underlying helper method. Attackers with low-privileged control panel access can exploit this flaw to read and exfiltrate the `.env` configuration file.\n\n## TL;DR\nLow-privileged users with template customizer access can read sensitive local files like `.env` using a sandbox bypass, leading to full database credential and security key compromise.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-200\n- **Attack Vector**: Network\n- **CVSS 4.0 Score**: 6.0\n- **EPSS Score**: 0.00268\n- **Impact**: Sensitive Information Disclosure / Local File Read\n- **Exploit Status**: PoC in technical advisories\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Craft CMS 4.x\n- Craft CMS 5.x\n- **Craft CMS**: >= 4.0.0-RC1, < 4.18.0 (Fixed in: `4.18.0`)\n- **Craft CMS**: >= 5.0.0-RC1, < 5.10.0 (Fixed in: `5.10.0`)\n\n## Mitigation\n\n- Upgrade Craft CMS to versions 4.18.0, 5.10.0, or newer.\n- Revoke the 'utility:system-messages' permission from non-administrative users.\n- Manually modify twig-sandbox.php config to strip the dataUrl function.\n\n**Remediation Steps:**\n1. Run 'composer update craftcms/cms' to pull the latest security release.\n2. Verify the installation of version 4.18.0+ or 5.10.0+.\n3. Inspect the database table 'systemmessages' for any unauthorized template injections containing 'dataUrl'.\n\n## References\n\n- [GitHub Security Advisory GHSA-287w-mxq6-x2cp](https://github.com/craftcms/cms/security/advisories/GHSA-287w-mxq6-x2cp)\n- [Craft CMS Pull Request 18559](https://github.com/craftcms/cms/pull/18559)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55792) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-06T21:42:10.955204Z"} 2026-07-06T21:42:10.955204+00:00 https://vulnerability.circl.lu/sighting/fc9ba849-3645-4ad7-b085-02e691cae621/export 2026-07-11T19:03:05.441390+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "fc9ba849-3645-4ad7-b085-02e691cae621", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55792", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpohizofjh2u", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-55792 \u0432 Craft CMS: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/16998440-7542-46D6-8484-7484AF6ABA1E", "creation_timestamp": "2026-07-02T16:33:25.615938Z"} 2026-07-02T16:33:25.615938+00:00 https://vulnerability.circl.lu/sighting/db6568a2-beaa-4214-a73b-e9311e43fc65/export 2026-07-11T19:03:05.441528+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "db6568a2-beaa-4214-a73b-e9311e43fc65", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55792", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpmrqnddb72m", "content": "CVE-2026-55792 - Craft CMS: Sensitive File Disclosure / Server-Side File Read\nCVE ID : CVE-2026-55792\n \n Published : July 1, 2026, 11:20 p.m. | 26\u00a0minutes ago\n \n Description : Craft CMS is a content management system (CMS). In versions starting from 4.0.0-RC1 and prior to 4.18...", "creation_timestamp": "2026-07-02T00:31:18.979700Z"} 2026-07-02T00:31:18.979700+00:00