CyberRota Analysis
AI-GeneratedCraft CMS versions 5.10.0 through 5.10.12 are vulnerable due to an incomplete fix that allows authenticated low-privilege users to exploit unsanitized input in the redirect URL, leading to server-side template injection and potential full server compromise. Organizations using affected versions should prioritize patching to version 5.10.13 to mitigate this high-severity vulnerability, especially those with user roles that can edit elements within the control panel.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Craft CMS versions 5.10.0 through 5.10.12 contain an incomplete fix for CVE-2026-55794: the Controller::getPostedRedirectUrl() -> View::renderObjectTemplate() sink remained unsandboxed, and the same fix commit added a self-signing oracle in Cp::elementLabelHtml(). Because Craft/Yii HMAC tokens are not bound to a parameter name, an authenticated low-privilege control panel user with edit rights on a single element type can mint a token over attacker-controlled Twig for the returnUrl parameter and replay it as the redirect POST parameter, reaching the unsandboxed sink and achieving server-side template injection that executes arbitrary PHP code (full server compromise). The issue is fixed in 5.10.13.