Vulnerability · Published Jul 1, 2026 · Assigned by GitHub_M

CVE-2026-55794Craft CMS: Potential authenticated Remote Code Execution via referrer redirect

High 8.7

In plain English

A high-severity code injection in cms from craftcms. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.4%top 64.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Craft CMS is a content management system (CMS). In versions 5.9.0 and above prior to 5.10.0, control panel users with the ability to edit entries can execute unsandboxed Twig code via the HTTP Referrer header, potentially leading to authenticated RCE. The issue happens when a user is saving entries. Strings for a signed redirect URL are being compiled as a Twig template via renderObjectTemplate(), and while a sandboxed alternative already exists (renderSandboxedObjectTemplate()), it is not used in this case. This signed URL can be specified by users, as it is reflected in the “Referer” HTTP request header, which is under attacker control. This issue has been fixed in version 5.10.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	craftcms/cms	5.10.0	GHSA-f74w-488g-8x5r

Affected products (as reported)

Vendor	Product	Versions
craftcms	cms	>= 5.9.0, < 5.10.0

Weakness: CWE-1336, CWE-94 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

References

https://github.com/craftcms/cms/security/advisories/GHSA-f74w-488g-8x5r x_refsource_CONFIRM
https://github.com/craftcms/cms/pull/18680 x_refsource_MISC