Craft CMS: Remote code execution via app/render-elements (CVE-2026-124430)
Craft CMS versions from 5.10.0 before 5.11.2 contain a remote code execution vulnerability that allows non-administrator control panel users to execute OS commands.
CVE search metadata
CVE search record: CVE-2026-124430. Severity: high. CVSS: 8.8. KEV: no. Product: Craft CMS (5.10.0 <= version < 5.11.2). Brief: Craft CMS: Remote code execution via app/render-elements (CVE-2026-124430). Brief link: https://feed.craftedsignal.io/briefs/2026-11-craft-cms-rce/
Triage facts
Revision 1- Applicability
- Craft CMS (5.10.0 <= version < 5.11.2)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 8, 15:30 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Craft CMS versions from 5.10.0 before 5.11.2 contain a remote code execution vulnerability. Non-administrator control panel users can obtain HMAC-signed Twig templates via the app/render-elements endpoint. By submitting the signed templated returnUrl as a login redirect parameter, attackers can trigger unsandboxed renderObjectTemplate() evaluation, resulting in OS command execution as the PHP worker.