nvd.nist.gov /vuln/detail/CVE-2026-55794

nvd.nist.gov • July 7, 2026

This CVE record is not being prioritized for NVD enrichment efforts due to resource or other concerns.

Craft CMS is a content management system (CMS). In versions 5.9.0 and above prior to 5.10.0, control panel users with the ability to edit entries can execute unsandboxed Twig code via the HTTP Referrer header, potentially leading to authenticated RCE. The issue happens when a user is saving entries. Strings for a signed redirect URL are being compiled as a Twig template via renderObjectTemplate(), and while a sandboxed alternative already exists (renderSandboxedObjectTemplate()), it is not used in this case. This signed URL can be specified by users, as it is reflected in the “Referer” HTTP request header, which is under attacker control. This issue has been fixed in version 5.10.0.

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address this page to [email protected] .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Craft CMS Vulnerability CVE-2026-55794 Allows Authenticated RCE via HTTP Referrer Craft CMS versions 5.9.0 and above prior to 5.10.0 are vulnerable to authenticated remote code execution (RCE) due to a flaw in how the control panel processes the HTTP Referrer header. Users with edit permissions can execute unsandboxed Twig code when saving entries, as the signed redirect URL is compiled as a Twig template without using a sandboxed alternative. This vulnerability has been assigned CVE-2026-55794 and was published on July 1, 2026. The issue has been addressed in Craft CMS version 5.10.0, and affected users are advised to update to this version or higher to mitigate the risk. 2 sources 58

Extracted Entities

nvd.nist.gov /vuln/detail/CVE-2026-55794

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Domains (1)

MITRE ATT&CK (1)

Platforms (2)