CVE-2026-55792: 
PHP vulnerability analysis and mitigation

CVE-2026-55792 is a sensitive file disclosure / server-side file read vulnerability in Craft CMS affecting versions 4.0.0-RC1 through 4.17.x and 5.0.0-RC1 through 5.9.x. The flaw allows any control panel user with the utility:system-messages permission to embed a dataUrl() Twig payload into system email templates, causing the server to read and exfiltrate arbitrary files — including the .env file — as base64-encoded data URLs in outbound emails. The vulnerability was first published on June 16, 2026 (GitHub Advisory), with NVD publication on July 1, 2026, and patched versions released as 4.18.0 and 5.10.0. It carries a CVSS v4.0 base score of 6.0 (Medium) (Github Advisory).

The root cause (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) stems from three compounding code facts: (1) the dataUrl() Twig function is explicitly included in Craft's Twig sandbox allowlist (src/config/twig-sandbox.php, line 115); (2) the Html::dataUrl() helper in src/helpers/Html.php applies four file-access checks (must be within project root, not in system directories, not a .php file, and must exist) — none of which block dotfiles like .env; and (3) system message bodies are rendered via renderSandboxedString() in src/mail/Mailer.php, executing any saved Twig content including dataUrl() calls when emails are sent. Because the utility:system-messages permission is a non-admin control panel permission grantable to any user group, the attack surface extends beyond administrators. The exploit was confirmed against Craft CMS 5.9.19 (Github Advisory).

Successful exploitation results in full exfiltration of the server-side .env file, which typically contains the database password, CRAFT_SECURITY_KEY, and third-party API keys. Obtaining CRAFT_SECURITY_KEY enables an attacker to forge valid session tokens and escalate privileges to full admin account takeover, effectively compromising the entire Craft CMS installation. Secondary impacts include unauthorized database access and potential compromise of any third-party services whose API keys are stored in .env (Github Advisory).

CISA's SSVC assessment classifies this vulnerability with exploitation status of "poc" and technical impact of "total," though it is not listed in the CISA KEV catalog (NVD). The EPSS score is approximately 0.268% (19th percentile), indicating a relatively low but non-negligible probability of exploitation in the near term (Github Advisory). No public proof-of-concept exploit code has been confirmed, and there is no evidence of active in-the-wild exploitation at this time. Exploitation is not automatable and requires an attacker to already possess a control panel account with the utility:system-messages permission.

1. Obtain access: Acquire a Craft CMS control panel account with the utility:system-messages permission (e.g., through credential theft, phishing, or a compromised low-privilege account).
2. Navigate to system messages: Log into the Craft CMS control panel and navigate to Utilities > System Messages.
3. Inject the payload: Edit any system email template (e.g., the account activation email) and insert a dataUrl() Twig payload targeting the .env file in the body field, for example: {{ dataUrl('@root/.env') }}.
4. Trigger email sending: Save the template and trigger the email to be sent (e.g., by initiating a password reset or account activation for a test user), causing the server to execute the Twig template via renderSandboxedString().
5. Retrieve exfiltrated data: Receive the outbound email, which will contain the .env file contents embedded as a data:text/plain;base64,... URL in the email body; decode the base64 string to recover plaintext credentials.
6. Escalate privileges: Use the extracted CRAFT_SECURITY_KEY to forge a valid session token for an admin account, achieving full administrative control of the Craft CMS instance (Github Advisory).

• Logs: Craft CMS application logs showing system email sends triggered by non-admin users with the utility:system-messages permission, particularly outside normal business hours or for unusual recipient addresses.
• Logs: Email delivery logs containing outbound messages with unusually large or base64-heavy bodies (indicative of embedded file contents as data URLs).
• File System: Review of system message templates in the database for the presence of dataUrl() Twig function calls, especially referencing paths like .env, /../, or other sensitive files.
• Network: Outbound SMTP traffic from the Craft CMS server containing data:text/plain;base64, strings in email bodies, which may be visible in mail server logs or email gateway inspection.
• Logs: Audit log entries in Craft CMS showing edits to system messages by non-admin users, followed shortly by email-triggering actions (Github Advisory).

Upgrade Craft CMS to version 4.18.0 or 5.10.0, which resolve the vulnerability by removing dataUrl() from the Twig sandbox allowlist or adding explicit dotfile/.env protections. As an immediate workaround, restrict the utility:system-messages permission to only fully trusted administrators via Settings > Users > Groups. If the .env file may have been exposed, rotate the CRAFT_SECURITY_KEY, database credentials, and all third-party API keys stored in .env immediately, and invalidate all active sessions (Github Advisory).

The vulnerability was reported by security researcher smakarim and published as a GitHub Security Advisory (GHSA-287w-mxq6-x2cp) on June 16, 2026. CISA-ADP added the vulnerability to NVD records on July 2, 2026, classifying it with a technical impact of "total" in their SSVC assessment. Social media activity was limited to automated CVE notification accounts on Bluesky and Nitter shortly after publication, with no notable independent researcher commentary or significant media coverage identified (Github Advisory).