Remote Code Execution in Craft CMS

Executive Summary

CVE-2026-124430 is a remote code execution (RCE) vulnerability in Craft CMS versions 5.10.0 through 5.11.1. Non-administrator control panel users can exploit the app/render-elements endpoint to obtain HMAC-signed Twig templates. Attackers submit a malicious signed template as a login redirect parameter, triggering unsandboxed evaluation of renderObjectTemplate() and executing arbitrary OS commands as the PHP worker.

Useful 0 Not Useful 0

Detection Guidance

• Check Craft CMS version with: composer show craftcms/cms or php craft version
• Inspect network traffic for requests to /app/render-elements with returnUrl parameters containing Twig templates
• Review server logs for unusual PHP command execution attempts or unsandboxed template evaluations

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute arbitrary operating system commands with the privileges of the PHP worker. This could lead to full system compromise, data theft, unauthorized access to sensitive information like security keys or database credentials, and potential lateral movement within the network.

Useful 0 Not Useful 0

Compliance Impact

This RCE vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in data breaches, unauthorized disclosures, and failure to maintain confidentiality and integrity of protected health information or personal data.

Useful 0 Not Useful 0

Mitigation Strategies

• Upgrade Craft CMS to version 5.11.2 or later immediately
• Restrict non-administrator control panel user permissions to minimum required
• Audit and rotate all Craft CMS security keys and credentials
• Monitor for suspicious login attempts or template submissions

Useful 0 Not Useful 0