Control panel only API response emulation replaces "securityKey" and reaches server RCE


Report #HCKRT-WM3VSE in Craft CMS Private Bug Bounty Program

Disclosed Report
StatusClosed
Resolved
TargetTier 1
craftcms/cms
Severity
High
Details
Program
Craft CMS Private Bug Bounty Program
Target
craftcms/cms
Creation Date
9/9/2026 2:09:16 AM
Severity
High
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CVE Number
CVE-2026-115935
Affected versions
>= 4.0.0, < 4.18.9 and >= 5.0.0, < 5.11.2
Visibility
Disclosed
Disclosed at
10/23/2026 9:34:44 PM
Author
@Kalawy
Status
Resolved (Closed)
Vulnerability Type (CAPEC™)
Remote Code Inclusion
Weakness (CWE)
(CWE-94) Improper Control of Generation of Code ('Code Injection')
Summary

The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user.

Description

A non-admin user with only accessCp can place newline characters in X-Craft-Plugin-Licenses. Craft passes this value to its .env writer without removing the newlines.

This lets the user insert a new attacker-known CRAFT_SECURITY_KEY into .env. After Craft loads that key, the user can forge a signed login redirect containing a Twig system() callback.

This is different from the previous report. That report reads the existing key through a Twig sandbox bypass. This report replaces the key through fake API headers and CRLF injection. Fixing either source does not fix the other.

Impact

A low-privileged control panel account can execute arbitrary operating system commands as the PHP worker.

Timeline
Kalawy

Created.

Wednesday, September 9, 2026 2:09 AM
Tyrell

Severity changed from Critical to High

Friday, September 11, 2026 6:33 AM
Tyrell

Changed to Accepted (Open)

Friday, September 11, 2026 6:33 AM
brandonkelly

Github Security Advisory has been created. GHSA-9hp6-3565-gvh5

Tuesday, September 15, 2026 6:55 PM
angrybrad

Changed to Resolved (Closed).

https://github.com/craftcms/cms/security/advisories/GHSA-9hp6-3565-gvh5 has been created for this and will be made public on October 19th. Thanks for the report!

Thursday, September 17, 2026 9:06 PM
Hackrate

Our platform helps companies to identify software vulnerabilities in a cost-efficient way. It provides a secure and centralized view of ethical hacking projects for your company.

US Patent Applied for HackGATE #63/645,845

Checking service status...
Company
Products
From the Blog
Hackrate is ISO 27001 certified

Hackrate Ethical Hacking Platform |
2026 ©

CVE Program Numbering Authority