Listen to this Post
The Craft vulnerability CVE-2026-31857 was initially patched by applying sandboxed Twig templating. This theoretically protects Craft CMS against RCE attacks, provided the sandbox is enabled and secure, with no known bypasses.
However, the same request parameter elementId, which allows for sandboxed Twig templates to be rendered, also includes functionality that interpolates referenced environment variables. If the parameter includes a string of the form ${ENV_VAR}, the string is replaced with the environment variable or secret from a secrets file with that name. Afterward, the string is rendered as a Twig template.
If the sandbox is disabled, Twig templates can already gain RCE or access environment variables using the `getenv` function. Sandboxed Twig templates should not have this access, but now do thanks to this additional environment-variable replacement behavior.
The template’s resulting value is not directly reflected in the response. To exfiltrate the value, the sandboxed Twig template cannot use network functions. But it can use a blind error-based approach similar to blind SQL injection. With enough requests, any environment variable or secret can be incrementally leaked.
This can be abused to forge a session, escalate privileges with the CRAFT_SECURITY_KEY, and steal credentials for the database, SMTP server, or other connected APIs or blob storage.
An authenticated attacker, with permission to access the control panel, can render a malicious Twig template and steal arbitrary environment variables and secrets with a large number of requests, even if the Twig sandbox is enabled through enableTwigSandbox().
DailyCVE Form
Platform: Craft CMS
Version: <5.9.9 (5.x), <4.17.4 (4.x)
Vulnerability: SSTI / Info Disclosure
Severity: High (8.1 CVSS)
date: 2026-03-11
Prediction: 2026-03-11 (patched)
What Undercode Say
The vulnerability stems from the `BaseElementSelectConditionRule::getElementIds()` method passing user-controlled input through renderObjectTemplate(). Even with enableTwigSandbox: true, the pre-rendering interpolation of `${ENV_VAR}` patterns exposes secrets.
To test for interpolation, one can use a blind approach. The following concept demonstrates the incremental leak:
Example blind leak for CRAFT_SECURITY_KEY (character by character)
for i in {1..64}; do
for char in {a..z} {0..9}; do
Craft a payload that triggers an error if the character matches
Actual Craft CMS endpoint and parameter structure required
curl -s -X POST "https://target.com/admin/actions/element-index/get-elements" \
-H "Cookie: craft_session=..." \
-d "criteria[bash]={elementId: '${CRAFT_SECURITY_KEY:$i:1}' eq '$char' ? (1/0) : 1}"
done
done
Exploit
The exploitation flow is as follows:
- Authentication: Attacker obtains basic Control Panel access (Author/Editor role).
- Payload Injection: The attacker injects a Twig payload into a condition rule via standard element listing endpoints.
- Interpolation: Craft CMS interpolates `${ENV_VAR}` patterns in the `elementId` parameter before sandboxed rendering.
- Blind Exfiltration: The attacker uses error-based logic to test characters of environment variables one by one.
- Privilege Escalation: With
CRAFT_SECURITY_KEY, the attacker can forge sessions. - Lateral Movement: Database, SMTP, and API credentials are stolen.
Note: Public proof-of-concept (PoC) exploits are available.
Protection
Upgrade: Immediately update to Craft CMS 5.9.9 or 4.17.4 (or newer).
Access Control: Restrict Control Panel access to only highly trusted personnel.
WAF Rules: Deploy Web Application Firewall rules to intercept POST payloads containing Twig syntax targeting index endpoints.
Audit: Audit the Control Panel user list and remove unnecessary accounts.
Impact
Confidentiality: High – All environment variables and secrets (.env, security key, DB credentials) can be leaked.
Integrity: High – Session forging allows privilege escalation.
Availability: High – Full server compromise possible.
Scope: Network-based attack, low complexity, requires authentication.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
