CVE-2026-72782

Deferred Deferred - Pending Action

Environment Variable Leak in Craft CMS

Publication date: 2026-08-11

Last updated on: 2026-10-24

Assigner: VulnCheck

Description

Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 interpolate environment variables and secrets (via ${ENV_VAR} strings in the elementId parameter) into Twig templates before rendering, even when the Twig sandbox is enabled. An authenticated attacker with control panel access can render a malicious sandboxed Twig template and, using a blind error-based technique across many requests, incrementally leak arbitrary environment variables and secrets. These can be abused to forge sessions (via CRAFT_SECURITY_KEY), escalate privileges, and steal database, SMTP, API, or blob storage credentials. Fixed in 5.10.6 and 4.18.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-10-24

Generated

2026-11-08

AI Q&A

2026-08-11

EPSS Evaluated

2026-11-07

NVD

CVE-2026-72782

EUVD

EUVD-2026-56106

Affected Vendors & Products

Vendor	Product	Version / Range
craftcms	craft_cms	From 5.0.0-RC1 (inc) to 5.10.6 (exc)
craftcms	craft_cms	From 4.0.0-RC1 (inc) to 4.18.2 (exc)
craftcms	craft_cms	5.10.6
craftcms	craft_cms	4.18.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-668	The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

Attack-Flow Graph

Executive Summary

This vulnerability affects Craft CMS versions 4.0.0-RC1 to 4.18.1 and 5.0.0-RC1 to 5.10.5. It allows authenticated attackers with control panel access to leak secret environment variables through Twig templates. The system interpolates environment variables in templates using syntax like ${ENV_VAR}, replacing them with actual values before rendering, even when the Twig sandbox is enabled. Attackers can use a blind error-based technique to extract these secrets incrementally.

Detection Guidance

Check Craft CMS version with: composer show craftcms/cms. If version is between 4.0.0-RC1-4.18.1 or 5.0.0-RC1-5.10.5, it is vulnerable. Inspect Twig templates for ${ENV_VAR} syntax in elementId parameter. Monitor for unusual error responses indicating secret leakage during template rendering.

Impact Analysis

An attacker could steal sensitive data such as database credentials, SMTP server details, API keys, or blob storage credentials. They may forge sessions using CRAFT_SECURITY_KEY, escalate privileges, or gain further access to the system. The impact includes potential data breaches, unauthorized access, and system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for GDPR and HIPAA. Exposure of personal or health data may result in legal penalties, reputational damage, and loss of trust. Organizations must patch immediately to maintain compliance.

Mitigation Strategies

Upgrade Craft CMS to version 5.10.6 or 4.18.2 or later immediately. Remove or sanitize ${ENV_VAR} syntax from Twig templates. Restrict control panel access to trusted users only. Rotate CRAFT_SECURITY_KEY and other exposed secrets. Review logs for prior exploitation attempts.

Hi! I’m here to help you understand CVE-2026-72782. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...