Craft CMS (5.10.0 <= Version < 5.11.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/craft-cms-5.10.0--version--5.11.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 08 Nov 2026 15:30:06 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCraft CMS: Remote code execution via app/render-elements (CVE-2026-124430)https://feed.craftedsignal.io/briefs/2026-11-craft-cms-rce/Sun, 08 Nov 2026 15:30:06 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-craft-cms-rce/Craft CMS versions from 5.10.0 before 5.11.2 contain a remote code execution vulnerability that allows non-administrator control panel users to execute OS commands.Craft CMS versions from 5.10.0 before 5.11.2 contain a remote code execution vulnerability. Non-administrator control panel users can obtain HMAC-signed Twig templates via the app/render-elements endpoint. By submitting the signed templated returnUrl as a login redirect parameter, attackers can trigger unsandboxed renderObjectTemplate() evaluation, resulting in OS command execution as the PHP worker.

]]>highadvisory