CVE-2026-72782
Received Received - Intake

Environment Variable Leak in Craft CMS

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: VulnCheck

Description
Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 interpolate environment variables and secrets (via ${ENV_VAR} strings in the elementId parameter) into Twig templates before rendering, even when the Twig sandbox is enabled. An authenticated attacker with control panel access can render a malicious sandboxed Twig template and, using a blind error-based technique across many requests, incrementally leak arbitrary environment variables and secrets. These can be abused to forge sessions (via CRAFT_SECURITY_KEY), escalate privileges, and steal database, SMTP, API, or blob storage credentials. Fixed in 5.10.6 and 4.18.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-72782
EUVD
EUVD-2026-56106

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
craftcms craft_cms From 5.0.0-RC1 (inc) to 5.10.6 (exc)
craftcms craft_cms From 4.0.0-RC1 (inc) to 4.18.2 (exc)
craftcms craft_cms 5.10.6
craftcms craft_cms 4.18.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-668 The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Craft CMS versions 4.0.0-RC1 to 4.18.1 and 5.0.0-RC1 to 5.10.5. It allows authenticated attackers with control panel access to leak secret environment variables through Twig templates. The system interpolates environment variables in templates using syntax like ${ENV_VAR}, replacing them with actual values before rendering, even when the Twig sandbox is enabled. Attackers can use a blind error-based technique to extract these secrets incrementally.

Detection Guidance

Check Craft CMS version with: composer show craftcms/cms. If version is between 4.0.0-RC1-4.18.1 or 5.0.0-RC1-5.10.5, it is vulnerable. Inspect Twig templates for ${ENV_VAR} syntax in elementId parameter. Monitor for unusual error responses indicating secret leakage during template rendering.

Impact Analysis

An attacker could steal sensitive data such as database credentials, SMTP server details, API keys, or blob storage credentials. They may forge sessions using CRAFT_SECURITY_KEY, escalate privileges, or gain further access to the system. The impact includes potential data breaches, unauthorized access, and system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for GDPR and HIPAA. Exposure of personal or health data may result in legal penalties, reputational damage, and loss of trust. Organizations must patch immediately to maintain compliance.

Mitigation Strategies

Upgrade Craft CMS to version 5.10.6 or 4.18.2 or later immediately. Remove or sanitize ${ENV_VAR} syntax from Twig templates. Restrict control panel access to trusted users only. Rotate CRAFT_SECURITY_KEY and other exposed secrets. Review logs for prior exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72782. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart