Advisory · CVE-2026-124430
Craft CMS control panel users can turn a template signing trick into remote code execution
Craft CMS 5.10.0 before 5.11.2 contains a remote code execution flaw that lets non-administrator control panel users obtain HMAC-signed Twig renderObjectTemplate evaluation and execute OS commands as the PHP worker, rated high at CVSS 8.8; fixed in 5.11.2.
- Vendor
- Craft CMS
- Product
- Craft CMS
- Identifier / CWE
- CVE-2026-124430
CWE-1336 - Action timing
- Immediate
Explain it like I’m five
Craft CMS signs certain template requests so only trusted parts of the system can ask for them. A flaw lets an ordinary control panel user get hold of a valid signature and then ask the template engine to run their own code as the web server.
- 01Control panel access
A non-administrator user logs in to the Craft CMS control panel.
- 02Signing oracle reached
The user reaches the app render-elements signing flow.
- 03Signed template obtained
An HMAC-signed renderObjectTemplate evaluation is obtained.
- 04Template evaluated
The signed template is evaluated by the Twig engine.
- 05Commands run
Operating system commands execute with the PHP worker's privileges.
What happened
Craft CMS from 5.10.0 before 5.11.2 contains a remote code execution vulnerability that allows non-administrator control panel users to obtain HMAC-signed Twig renderObjectTemplate evaluation and execute operating system commands as the PHP worker. The record rates it high at CVSS 8.8 under version 3.1, with network attack vector, low complexity, low privileges required, and no user interaction.
The attacker needs a control panel account, but no administrator role, and the result is code execution as the web server. The flaw is fixed in Craft CMS 5.11.2.
What to do
- Inventory Craft CMS deployments and record each version.
- Upgrade to Craft CMS 5.11.2 or later.
- Audit control panel accounts, especially non-administrator accounts with recent activity.
- Review template rendering and process logs for unusual renderObjectTemplate use.
- Rotate credentials and review server-side changes if code execution cannot be excluded.
- Verify the deployed version after updating.
Management note
A template engine that runs attacker code is a server compromise, not a template bug. Any non-admin account active in the window deserves a second look.