Authenticated Remote Code Execution via Twig Template in Craft CMS

Executive Summary

CVE-2026-55794 is a vulnerability in Craft CMS versions 5.9.0 up to but not including 5.10.0. It allows authenticated control panel users who can edit entries to execute unsandboxed Twig code through the HTTP Referrer header. This happens because when saving entries, the system compiles strings for a signed redirect URL as a Twig template without sandboxing, using the function renderObjectTemplate(). Since the Referrer header is user-controlled, an attacker can manipulate it to inject malicious Twig code, potentially leading to remote code execution (RCE). This vulnerability was fixed in version 5.10.0.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have a severe impact because it allows an authenticated user with entry editing permissions to execute arbitrary code on the server. This means an attacker could potentially take full control of the affected system, leading to data breaches, unauthorized access, or disruption of services. Since the exploit requires authentication, the risk is limited to users with certain privileges, but the consequences of exploitation are high.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves exploitation via the HTTP Referrer header when authenticated users with entry editing permissions save entries in Craft CMS versions 5.9.0 to before 5.10.0.

To detect potential exploitation attempts on your system or network, you can monitor HTTP requests for suspicious or unusual Referer headers containing Twig template syntax or unexpected code patterns.

For example, you can use network traffic inspection tools or web server logs to search for Referer headers with Twig expressions like {{ or {%.

Suggested commands to search web server logs (assuming Apache or Nginx logs):

• grep -i 'Referer:.*{{' /var/log/nginx/access.log
• grep -i 'Referer:.*{%' /var/log/apache2/access.log
• Use tools like tcpdump or Wireshark to capture HTTP traffic and filter for Referer headers containing Twig syntax.

Additionally, monitoring for unusual activity by authenticated users with entry editing permissions, especially around saving entries, can help detect exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

The primary and most effective mitigation step is to upgrade Craft CMS to version 5.10.0 or later, where this vulnerability has been fixed.

Until the upgrade can be performed, consider restricting entry editing permissions to trusted users only, as the vulnerability requires authenticated users with entry editing rights.

Additionally, monitor and filter HTTP requests to detect and block suspicious Referer headers that may contain malicious Twig code.

Review and apply any available security patches or updates provided by Craft CMS promptly.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0