CVE-2026-55794: 
PHP vulnerability analysis and mitigation

CVE-2026-55794 is an authenticated Remote Code Execution (RCE) vulnerability in Craft CMS caused by unsandboxed Twig template injection via the HTTP Referer header. It affects Craft CMS versions 5.9.0 through 5.10.0 (exclusive), and was first published by the researcher "angrybrad" on June 16, 2026, with NVD publication on July 2, 2026. The vulnerability carries a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Feedly).

The root cause is improper use of Craft CMS's renderObjectTemplate() function — which executes Twig templates without sandboxing — instead of the available renderSandboxedObjectTemplate() alternative (CWE-94: Code Injection; CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine). When a control panel user saves an entry, the application constructs a signed redirect URL by compiling a string derived from the HTTP Referer request header as a Twig template. Because the Referer header is fully attacker-controlled, a malicious user can inject arbitrary Twig expressions that are executed server-side without sandboxing restrictions. The fix, implemented in pull request #18680, replaces the referrer-based redirect logic with explicitly set returnUrl parameters on element edit pages, eliminating the untrusted input from the template rendering pipeline (GitHub Advisory, GitHub PR #18680).

Successful exploitation allows an authenticated control panel user with entry-editing permissions to execute arbitrary code on the server with the privileges of the web server process, resulting in full compromise of confidentiality, integrity, and availability of the vulnerable system. An attacker could read sensitive application data (database credentials, API keys, user data), modify or delete content, establish persistent backdoors, or pivot to other internal systems accessible from the web server. The CVSS v4.0 scoring reflects high impact across all three pillars for the vulnerable system (GitHub Advisory, Feedly).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable, given that it requires authenticated access with specific entry-editing permissions. The EPSS score is approximately 0.293% (21st percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (GitHub Advisory).

1. Obtain Credentials: Acquire valid Craft CMS control panel credentials for an account with at least entry-editing permissions (e.g., via phishing, credential stuffing, or insider access).
2. Log into the Control Panel: Authenticate to the target Craft CMS instance's control panel (typically at /admin or a custom path).
3. Navigate to an Entry Edit Page: Browse to any entry edit page within the control panel (e.g., /admin/entries/blog/1-my-entry).
4. Craft a Malicious Referer Header: Prepare an HTTP request to save the entry, but set the Referer header to a URL containing a malicious Twig payload, such as: Referer: http://example.com/{{['id']|filter('system')}}
5. Submit the Save Request: Send the crafted POST request (e.g., using Burp Suite or a custom script) to the entry save endpoint. The application reads the Referer header, constructs a signed redirect URL, and passes it through renderObjectTemplate() without sandboxing.
6. Achieve Code Execution: The injected Twig expression is evaluated server-side, executing the embedded system command with web server process privileges, enabling reverse shell establishment, data exfiltration, or further lateral movement (GitHub Advisory, GitHub PR #18680).

• Network: HTTP POST requests to Craft CMS entry save endpoints (e.g., /admin/entries/*) where the Referer header contains Twig template syntax such as {{, }}, |filter, or system; unexpected outbound connections from the web server to external IPs following entry save operations.
• Logs: Web server access logs showing entry save requests with anomalous Referer header values containing template delimiters or encoded payloads; Craft CMS application logs recording Twig rendering errors or unexpected template evaluation output.
• File System: Newly created web shell files or scripts in the Craft CMS web root or writable directories; unexpected modifications to configuration files (e.g., .env) by the web server process.
• Process: Unusual child processes spawned by the PHP or web server process (e.g., sh, bash, curl, wget, python) following entry save operations; unexpected cron jobs or scheduled tasks created under the web server user account.

The primary remediation is to upgrade Craft CMS to version 5.10.0 or later, which replaces the referrer-based redirect logic with explicitly set returnUrl parameters, eliminating the untrusted input from the Twig rendering pipeline (GitHub Advisory, GitHub PR #18680). As a short-term workaround where immediate upgrade is not possible, restrict control panel access and entry-editing permissions to the minimum set of trusted users. Additionally, consider deploying a web application firewall (WAF) rule to detect and block requests with Twig template syntax ({{, }}) in the Referer header targeting Craft CMS save endpoints.

The vulnerability was disclosed by researcher "angrybrad" via GitHub's security advisory process on June 16, 2026, and was formally published to the GitHub Advisory Database on July 6, 2026. Automated CVE tracking accounts on Bluesky and Nitter noted the disclosure shortly after NVD publication. No significant broader media coverage or notable independent researcher commentary beyond the official advisory has been identified at this time (GitHub Advisory).