Description
The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user.



A non-admin user with only accessCp can place newline characters in X-Craft-Plugin-Licenses. Craft passes this value to its .env writer without removing the newlines.



This lets the user insert a new attacker-known CRAFT_SECURITY_KEY into .env. After Craft loads that key, the user can forge a signed login redirect containing a Twig system() callback.



This is different from the previous report. That report reads the existing key through a Twig sandbox bypass. This report replaces the key through fake API headers and CRLF injection. Fixing either source does not fix the other.
Published: 2026-10-23
Score: 8.7 High
EPSS: n/a
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 21:45:00 +0000

Type Values Removed Values Added
Description The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user. A non-admin user with only accessCp can place newline characters in X-Craft-Plugin-Licenses. Craft passes this value to its .env writer without removing the newlines. This lets the user insert a new attacker-known CRAFT_SECURITY_KEY into .env. After Craft loads that key, the user can forge a signed login redirect containing a Twig system() callback. This is different from the previous report. That report reads the existing key through a Twig sandbox bypass. This report replaces the key through fake API headers and CRLF injection. Fixing either source does not fix the other.
Title Control panel only API response emulation replaces "securityKey" and reaches server RCE
First Time appeared Craftcms
Craftcms cms
Weaknesses CWE-94
CPEs cpe:2.3:a:craftcms:cms:*:*:*:*:*:*:*:*
Vendors & Products Craftcms
Craftcms cms
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Craftcms Cms
cve-icon MITRE

Status: PUBLISHED

Assigner: Hackrate

Published:

Updated: 2026-10-23T21:40:57.592Z

Reserved: 2026-10-23T21:23:18.607Z

Link: CVE-2026-115935

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-23T22:16:59.290

Modified: 2026-10-23T22:16:59.290

Link: CVE-2026-115935

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T22:30:14Z

Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')