Craft CMS: CRLF injection in app/process-api-response-headers (CVE-2026-115935)

Craft CMS is vulnerable to a CRLF injection flaw within the 'app/process-api-response-headers' action. Authenticated users with 'accessCp' permissions can inject newline characters into the 'X-Craft-Plugin-Licenses' header. This input is processed by the application and written to the '.env' file without sanitization, allowing an attacker to replace the legitimate 'CRAFT_SECURITY_KEY' with one of their choosing. This compromise of the security key enables the forging of signed login redirects containing malicious Twig 'system()' callbacks for remote code execution.

Attack Chain

1. Attacker authenticates to the Craft Control Panel with 'accessCp' permissions.
2. Attacker sends a request containing the 'X-Craft-Plugin-Licenses' header populated with newline-injected payload data.
3. The 'app/process-api-response-headers' action processes the malicious header.
4. The application writes the injected header content to the '.env' file, successfully overwriting 'CRAFT_SECURITY_KEY'.
5. Application reloads, adopting the attacker-controlled 'CRAFT_SECURITY_KEY'.
6. Attacker generates a forged, signed login redirect string using the known security key.
7. Attacker triggers the signed login redirect, causing the server to execute the embedded Twig 'system()' callback.

Impact

Successful exploitation allows for remote code execution under the context of the web server process.

Recommendation

Patch Craft CMS installations immediately upon the release of a security update addressing CVE-2026-115935. Monitor administrative access logs for unusual header injection patterns or modifications to the '.env' file.