CVE-2026-72782: Craft CMS 5.0.0-RC1 before 5.10.6 Environment Variable Leak
Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 interpolate environment variables and secrets (via ${ENVVAR} strings in the elementId parameter) into Twig templates before rendering, even when the Twig sandbox is enabled. An authenticated attacker with control panel access can render a malicious sandboxed Twig template and, using a blind error-based technique across many requests, incrementally leak arbitrary environment variables and secrets. These can be abused to forge sessions (via CRAFTSECURITYKEY), escalate privileges, and steal database, SMTP, API, or blob storage credentials. Fixed in 5.10.6 and 4.18.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Craft CMSto a version that resolves this vulnerability.Fixed in 5.10.6 - Upgrade
Upgrade
Craft CMSto a version that resolves this vulnerability.Fixed in 4.18.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72782?
CVE-2026-72782 has a medium severity level of 6.5.
How do I fix CVE-2026-72782?
To fix CVE-2026-72782, you should upgrade Craft CMS to version 5.10.6 or later, or to version 4.18.2 or later.
What vulnerability does CVE-2026-72782 address?
CVE-2026-72782 addresses an environment variable leak in Craft CMS where secrets are interpolated into Twig templates.
Who is affected by CVE-2026-72782?
Authenticated users with control panel access in Craft CMS versions 5.0.0-RC1 to 5.10.6 and 4.0.0-RC1 to 4.18.2 are affected.
What is the impact of CVE-2026-72782?
The impact of CVE-2026-72782 is that it could lead to unauthorized disclosure of sensitive environment variables and secrets.