CVE-2026-55794: Authenticated Remote Code Execution via Template Injection in Craft CMS

Craft CMS version 5.9.0 introduced a referrer-based redirect mechanism designed to return administrative users to their original entry index page after updating elements in the Control Panel. This mechanism trusted the client-supplied HTTP Referer header, exposing an unintended entry point for template injection.

This security weakness is classified under CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine), which cascades into CWE-94 (Improper Control of Generation of Code). When an authorized user executes an element save action, the application processes the client's HTTP Referer header through an unsandboxed Twig template rendering routine.

An attacker who has permissions to edit at least one entry type can exploit this vector to execute arbitrary system commands on the host server. The attack surface is limited to authenticated control panel users, but because any element editor can trigger it, the risk of privilege escalation and full server takeover remains severe.

The root cause of this vulnerability lies in the implementation of the post-save redirect resolution inside src/controllers/ElementsController.php. When an entry is successfully updated, the controller resolves the destination URL using a prioritized sequence: first checking for a signed returnUrl query parameter, falling back to UrlHelper::cpReferralUrl(), and finally defaulting to the standard post-edit URL.

The helper function UrlHelper::cpReferralUrl() directly retrieves the raw HTTP Referer request header without validation or sanitization. Since HTTP headers are entirely client-controlled, any string, including specialized Twig template expressions, can be injected into this value by an attacker.

Once the controller obtains this unchecked referrer string, it passes it to the getPostedRedirectUrl() method in the base controller class src/web/Controller.php. This method attempts to evaluate dynamic placeholders inside the URL string using renderObjectTemplate(). Because renderObjectTemplate() evaluates input in an unsandboxed state, the Twig engine compiles and executes any embedded expressions, leading to remote code execution.

To understand the core flaw, it is necessary to examine the differences between the vulnerable implementation and the remediation introduced in version 5.10.0. The vulnerable code in ElementsController.php did not validate whether the redirect URL was cryptographically signed before executing template rendering. It blindly fell back to the referrer header:

// Vulnerable redirect resolution logic
$redirectUrl = $this->request->getValidatedQueryParam('returnUrl') ?? UrlHelper::cpReferralUrl() ?? ElementHelper::postEditUrl($element);

The remediation implemented in Pull Request #18680 entirely deprecates UrlHelper::cpReferralUrl() and strictly mandates signature verification for any custom returnUrl containing template syntax:

// Patched logic in ElementsController.php
$redirectUrl = $this->request->getQueryParam('returnUrl');
if ($redirectUrl) {
    // Validate cryptographic signature
    $validated = Craft::$app->getSecurity()->validateData($redirectUrl);
    if ($validated !== false) {
        $redirectUrl = $validated;
    } elseif (str_contains($redirectUrl, '{')) {
        // Reject raw template expressions
        throw new BadRequestHttpException("Invalid returnUrl param: $redirectUrl");
    }
} else {
    $redirectUrl = ElementHelper::postEditUrl($element);
}

This defensive design is highly complete. By verifying the cryptographic signature of the template-containing parameter, the server ensures that only internally generated templates are compiled. Any untrusted, user-supplied templates will fail validation and trigger a BadRequestHttpException before reaching the execution phase.

Exploitation of CVE-2026-55794 requires the attacker to possess an active session on the Craft CMS Control Panel. The session must belong to an account authorized to edit elements, such as entries, assets, or categories. This prerequisite makes the vulnerability highly relevant to multi-tenant environments or sites with multiple content editors.

To execute the attack, the adversary prepares a standard HTTP POST request directed to the entry-saving endpoint, typically actions/entries/save-entry. During this request, the attacker modifies the standard Referer header to include an unsandboxed Twig payload. The payload leverages filters such as filter or map mapped to standard PHP system execution functions like system or exec.

POST /index.php?p=admin/actions/entries/save-entry HTTP/1.1
Host: target.local
Authorization: Bearer <session_token>
Referer: http://target.local/admin/entries/pages?r={{['uname -a']|map('system')|join}}
Content-Type: application/x-www-form-urlencoded
 
... (POST Data) ...

When the server processes the post-save redirect sequence, it falls back to the malicious Referer header value. The server compiles this header value using the unsandboxed Twig rendering function, leading to the immediate execution of the command uname -a on the host operating system. The output of the command may be rendered in the subsequent redirection response or executed out-of-band depending on the environment context.

The security impact of CVE-2026-55794 is classified as high, reflected by its CVSS v4.0 base score of 8.7. The vulnerability receives high impact ratings across all primary dimensions: Confidentiality, Integrity, and Availability (VC:H/VI:H/VA:H). Because the injection results in remote command execution, the attacker effectively inherits the operational privileges of the underlying web server user account (e.g., www-data or apache).

With command execution privileges, an attacker can read sensitive configuration files, including database credentials stored in the .env file, and completely compromise the backend database. This database access can then be leveraged to extract customer data, administrative session cookies, or proprietary assets. Additionally, the attacker can write files to the webroot to establish persistent backdoors or web shells, guaranteeing continued access even after the session expires.

While the vulnerability requires authentication, the low privilege level required (element editor) increases the risk of insider threats and privilege escalation. If an external attacker compromises a lower-privileged account via credential stuffing or phishing, they can immediately elevate their access to full system-level control by triggering this flaw.

The primary recommendation to mitigate CVE-2026-55794 is to upgrade the Craft CMS installation to version 5.10.0 or later. This version contains the official security patch, which eliminates the use of the client-controlled Referer header and enforces rigorous cryptographic signature verification on the returnUrl query parameter.

In scenarios where an immediate upgrade is not feasible, temporary mitigation strategies must be applied. Web Application Firewalls (WAFs) should be configured with custom rules to inspect the Referer header of incoming HTTP requests targeting control panel actions. The rule should reject any requests containing curly braces ({ or }) or known Twig syntax elements directed at administrative endpoints.

Additionally, system administrators should audit control panel user permissions to ensure that only trusted individuals have permission to edit entries or elements. System activity and web server access logs should be monitored for unexpected or malformed Referer headers containing non-alphanumeric patterns, which are indicative of exploitation attempts.