Craft CMS (All Versions Prior to Security Patch) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/craft-cms-all-versions-prior-to-security-patch/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 24 Oct 2026 00:03:34 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCraft CMS: CRLF injection in app/process-api-response-headers (CVE-2026-115935)https://feed.craftedsignal.io/briefs/2026-10-craft-cms-cve-2026-115935/Sat, 24 Oct 2026 00:03:34 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-craft-cms-cve-2026-115935/Craft CMS contains a CRLF injection vulnerability that allows authenticated users to overwrite the CRAFT_SECURITY_KEY in the .env file, facilitating arbitrary code execution via forged signed login redirects.Craft CMS is vulnerable to a CRLF injection flaw within the 'app/process-api-response-headers' action. Authenticated users with 'accessCp' permissions can inject newline characters into the 'X-Craft-Plugin-Licenses' header. This input is processed by the application and written to the '.env' file without sanitization, allowing an attacker to replace the legitimate 'CRAFT_SECURITY_KEY' with one of their choosing. This compromise of the security key enables the forging of signed login redirects containing malicious Twig 'system()' callbacks for remote code execution.

Attack Chain

  1. Attacker authenticates to the Craft Control Panel with 'accessCp' permissions.
  2. Attacker sends a request containing the 'X-Craft-Plugin-Licenses' header populated with newline-injected payload data.
  3. The 'app/process-api-response-headers' action processes the malicious header.
  4. The application writes the injected header content to the '.env' file, successfully overwriting 'CRAFT_SECURITY_KEY'.
  5. Application reloads, adopting the attacker-controlled 'CRAFT_SECURITY_KEY'.
  6. Attacker generates a forged, signed login redirect string using the known security key.
  7. Attacker triggers the signed login redirect, causing the server to execute the embedded Twig 'system()' callback.

Impact

Successful exploitation allows for remote code execution under the context of the web server process.

Recommendation

Patch Craft CMS installations immediately upon the release of a security update addressing CVE-2026-115935. Monitor administrative access logs for unusual header injection patterns or modifications to the '.env' file.

]]>highadvisoryweb-applicationcmscrlf-injectionrceauthentication-bypass