CVE-2026-55794

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-55794
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55794.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-55794
Aliases
Published
2026-07-01T23:26:22.071Z
Modified
2026-07-08T08:13:49.285139017Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L CVSS Calculator
Summary
Craft CMS: Potential authenticated Remote Code Execution via referrer redirect
Details

Craft CMS is a content management system (CMS). In versions 5.9.0 and above prior to 5.10.0, control panel users with the ability to edit entries can execute unsandboxed Twig code via the HTTP Referrer header, potentially leading to authenticated RCE. The issue happens when a user is saving entries. Strings for a signed redirect URL are being compiled as a Twig template via renderObjectTemplate(), and while a sandboxed alternative already exists (renderSandboxedObjectTemplate()), it is not used in this case. This signed URL can be specified by users, as it is reflected in the “Referer” HTTP request header, which is under attacker control. This issue has been fixed in version 5.10.0.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55794.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-1336",
        "CWE-94"
    ]
}
References

Affected packages

Git / github.com/craftcms/cms

Affected ranges

Type
GIT
Repo
https://github.com/craftcms/cms
Events
Introduced
680259a1eef848ad601382e8b45a32d52f2d02b2
Fixed
a516a6190ba8ef39a7603863df9ae09eb89f3a64
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "5.9.0"
        },
        {
            "fixed": "5.10.0"
        }
    ]
}

Affected versions

5.*
5.9.0
5.9.1
5.9.10
5.9.11
5.9.12
5.9.13
5.9.14
5.9.15
5.9.16
5.9.17
5.9.18
5.9.19
5.9.2
5.9.20
5.9.21
5.9.22
5.9.23
5.9.3
5.9.4
5.9.5
5.9.6
5.9.7
5.9.8
5.9.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55794.json"