Skip to content
Threat Feed
Subscribe

Product

Craft CMS (>= 5.9.0, < 5.10.0)

1 brief RSS
high advisory

Craft CMS Authenticated RCE (CVE-2026-55794) via Referer Header Twig Injection

An authenticated Remote Code Execution (RCE) vulnerability, CVE-2026-55794, affects Craft CMS versions 5.9.0 up to, but not including, 5.10.0, allowing a control panel user with entry editing permissions to exploit by injecting unsandboxed Twig code into the HTTP Referer header when saving an entry, leading to arbitrary code execution.

Craft CMS rce web-application craft-cms cve authenticated-rce
1r 2t 1c