Craft CMS (All Versions Prior to Security Patch)

Craft CMS contains a CRLF injection vulnerability that allows authenticated users to overwrite the CRAFT_SECURITY_KEY in the .env file, facilitating arbitrary code execution via forged signed login redirects.