CVE-2026-92591: Craft CMS 5.0.0 before 5.10.13 Environment Secret Exposure via Installer
Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning that Craft is not installed, which makes anonymous installer actions — including install/validate-site — reachable on an installed production site whenever PHP remains available but the configured MySQL endpoint does not. The action accepts a site name, serializes it through Site::getName(), and expands ${NAME} expressions using App::env(). An unauthenticated attacker who obtained a guest session cookie and matching CSRF token before the outage and whose session remains valid during it can submit a predictable variable name (for example Craft's conventional CRAFTSECURITYKEY) and receive its value, disclosing Craft secrets, process environment variables, $SERVER entries, or PHP constants such as the security key, database credentials, or API keys. The issue requires an independently occurring database outage; the vulnerability itself provides no way to induce it. Fixed in 5.10.13.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Craft CMSto a version that resolves this vulnerability.Fixed in 5.10.13
Event History
Frequently Asked Questions
What conditions must exist for exploitation?
The configured MySQL endpoint must be unavailable while PHP remains available, causing the installed site to expose installer actions. The attacker must also already possess a valid guest session cookie and matching CSRF token obtained before the outage, and that session must remain valid during the outage.
Can an attacker trigger the required database outage through this vulnerability?
No. The vulnerability provides no way to induce a database outage; the MySQL connectivity failure must occur independently.
What information could be exposed?
An attacker can request predictable environment-variable expressions and receive their values. Exposed data may include the Craft security key, database credentials, API keys, process environment variables, $_SERVER entries, and PHP constants.
Which versions should be remediated?
Craft CMS versions 5.0.0 through 5.10.12 are affected. The issue is fixed in version 5.10.13.