{"id":"CVE-2026-55792","aliases":["GHSA-287w-mxq6-x2cp"],"title":"Craft CMS: Sensitive File Disclosure / Server-Side File Read","summary":"Craft CMS: Sensitive File Disclosure / Server-Side File Read","severity":"medium","cwe":["CWE-200"],"vendor":"craftcms","product":"craftcms/cms","ecosystem":"composer","affected":["craftcms/cms >= 4.0.0-RC1, < 4.18.0","craftcms/cms >= 5.0.0-RC1, < 5.10.0"],"patched":["craftcms/cms 4.18.0","craftcms/cms 5.10.0"],"published":"2026-07-06","updated":"2026-07-06","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-287w-mxq6-x2cp","references":[{"url":"https://github.com/craftcms/cms/security/advisories/GHSA-287w-mxq6-x2cp"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55792"},{"url":"https://github.com/craftcms/cms/pull/18559"},{"url":"https://github.com/advisories/GHSA-287w-mxq6-x2cp"}],"tags":["ghsa","composer"],"epss":0.00397,"epssPercentile":0.33665,"ingestedAt":"2026-07-06T21:45:52.918Z","slug":"CVE-2026-55792","body":"## Overview\n\nThe `dataUrl()` Twig function is included in Craft’s Twig sandbox allowlist, allowing any control panel user granted the `utility:system-messages` permission to embed a file-reading payload into system email templates. When those emails are sent, the server reads the target file and returns its contents as a base64-encoded data URL embedded in the email body. The .env file, which typically contains the database password, CRAFT_SECURITY_KEY, and third-party API keys, passes all of Craft’s existing `dataUrl()` protection checks and is fully exfiltrated. Obtaining CRAFT_SECURITY_KEY enables an attacker to forge session tokens and escalate to full admin account takeover.\n\n## Details\nAffected versions: Craft CMS 4.x, 5.x (confirmed against 5.9.19)\n\nThe vulnerability arises from the combination of three code facts:\n1. dataUrl is in the Twig sandbox allowlist\nsrc/config/twig-sandbox.php, line 115:\nphp'allowedFunctions' => [\n    ...\n    'dataUrl',   // ← allows file reading inside sandboxed templates\n    ...\n],\n\n2. Html::dataUrl() does not block dotfiles\nsrc/helpers/Html.php, lines 1065–1090. The function applies four checks before reading a file:\n\nMust be within the project root .env is at the root\nMust not be in a system directory (config/, vendor/, storage/, templates/) .env is not\nMust not be a .php file  .env has no extension\nFile must exist .env always exists in a Craft install\n\nThere is no check for dotfiles or specifically for .env. All four checks pass silently and file_get_contents() is called, with the result returned as data:text/plain;base64,....\n\n3. System message body is rendered via renderSandboxedString()\nsrc/mail/Mailer.php, lines 181–183:\nphp$subject = $view->renderSandboxedString($systemMessage->subject, $variables);\n$textBody = $view->renderSandboxedString($systemMessage->body, $variables);\n$htmlBody = $view->renderSandboxedString($systemMessage->body, $variables, escapeHtml: true);\n\nAny body content saved to a system message is executed inside the Twig sandbox when the email renders. Because dataUrl is in allowedFunctions, the sandbox policy permits its execution without restriction.\n\nAccess control: The utility:system-messages permission is a non-admin CP permission grantable to any user group via Settings > Users > Groups. It is not restricted to admins.\n\n## Impact\nVulnerability type: Sensitive File Disclosure / Server-Side File Read\nWho is impacted: Any Craft CMS 4.x or 5.x installation where at least one non-admin control panel user has been granted the utility:system-messages permission, and email sending is configured.\n\nResources:\n\n- https://github.com/craftcms/cms/pull/18559\n\n## Affected packages\n\n- `craftcms/cms >= 4.0.0-RC1, < 4.18.0`\n- `craftcms/cms >= 5.0.0-RC1, < 5.10.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `craftcms/cms 4.18.0`\n- `craftcms/cms 5.10.0`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}