{
  "affected": [
    {
      "affectedData": [
        {
          "product": "cms",
          "vendor": "craftcms",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.0.0-RC1, \u003c 4.18.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.0.0-RC1, \u003c 5.10.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Craft CMS is a content management system (CMS). In versions starting from 4.0.0-RC1 and prior to 4.18.0, and 5.0.0-RC1 and above, prior to 5.10.0, the dataUrl() Twig function is included in Craft\u2019s Twig sandbox allowlist, allowing any control panel user granted the utility:system-messages permission to embed a file-reading payload into system email templates. When those emails are sent, the server reads the target file and returns its contents as a base64-encoded data URL embedded in the email body. The .env file, which typically contains the database password, CRAFT_SECURITY_KEY, and third-party API keys, passes all of Craft\u2019s existing dataUrl() protection checks and is fully exfiltrated. Obtaining CRAFT_SECURITY_KEY enables an attacker to forge session tokens and escalate to full admin account takeover. This issue has been fixed in versions 4.18.0 and 5.10.0."
    },
    {
      "lang": "es",
      "value": "Craft CMS es un sistema de gesti\u00f3n de contenido (CMS). En versiones a partir de 4.0.0-RC1 y anteriores a 4.18.0, y 5.0.0-RC1 y superiores, anteriores a 5.10.0, la funci\u00f3n Twig dataUrl() est\u00e1 incluida en la lista de permitidos (allowlist) del sandbox de Twig de Craft, permitiendo a cualquier usuario del panel de control con el permiso utility:system-messages incrustar una carga \u00fatil (payload) de lectura de archivos en las plantillas de correo electr\u00f3nico del sistema. Cuando se env\u00edan esos correos electr\u00f3nicos, el servidor lee el archivo objetivo y devuelve su contenido como una URL de datos codificada en base64 incrustada en el cuerpo del correo electr\u00f3nico. El archivo .env, que normalmente contiene la contrase\u00f1a de la base de datos, CRAFT_SECURITY_KEY y claves API de terceros, pasa todas las comprobaciones de protecci\u00f3n dataUrl() existentes de Craft y es completamente exfiltrado. La obtenci\u00f3n de CRAFT_SECURITY_KEY permite a un atacante falsificar tokens de sesi\u00f3n y escalar a una toma de control completa de la cuenta de administrador. Este problema ha sido solucionado en las versiones 4.18.0 y 5.10.0."
    }
  ],
  "id": "CVE-2026-55792",
  "lastModified": "2026-10-25T21:10:00.770",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 6.0,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-55792",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-02T14:48:43.714822Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-02T00:16:44.940",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/craftcms/cms/pull/18559"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/craftcms/cms/security/advisories/GHSA-287w-mxq6-x2cp"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/craftcms/cms/pull/18559"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}