CVE-2026-124430

Summary

A flaw in Craft CMS (5.10.0–5.11.1) allows non-admin control panel users to exploit HMAC-signed Twig templates via the app/render-elements endpoint, leading to remote code execution through unsandboxed template rendering. Attackers abuse the login redirect mechanism to trigger arbitrary OS command execution as the PHP worker.

Exploitability

Exploitation requires valid non-admin control panel credentials and knowledge of the vulnerable endpoint; public exploits exist, making it trivial for attackers with low privileges.

Blast radius

Successful exploitation grants full system compromise with root-level privileges on the web server, enabling data theft, lateral movement, and persistent backdoor installation.

Detection

Monitor for anomalous POST requests to /index.php?p=admin/actions/app/render-elements with a returnUrl parameter containing signed Twig templates (e.g., base64-encoded strings ending in .html.twig or containing {{ }} syntax), especially when followed by unexpected PHP process spawning or filesystem writes in web-accessible directories.

Prioritized remediation

Upgrade to Craft CMS 5.11.2 or later immediately; if upgrading is delayed, disable the app/render-elements endpoint for non-admin users and enforce strict access controls via web application firewall rules.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.