CVE-2026-92592

CVE-2026-92592 is a signature-purpose-confusion flaw in Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12: the license-shun cookie and signed redirect parameters are validated with the same HMAC key and format (Yii's cookieValidationKey derived from the shared Craft securityKey), so a signature minted for one purpose is accepted for the other. An authenticated non-administrator user (Control Panel access is not required) can obtain a signed cookie via the license-shun endpoint and transplant that signed envelope into a redirect parameter; on a subsequent successful login, Craft validates the signature and renders the authenticated bytes as an unsandboxed Twig template, where Twig's map filter accepts a string callback that permits calling PHP system(). A successful attacker thereby executes arbitrary operating-system commands as the web-server user on the CMS host. Exploitation requires an account using password authentication without active 2FA, the default request configuration, and availability of PHP system(). No public proof-of-concept is known, the flaw is not in CISA's KEV, and there is no confirmed in-the-wild exploitation.

What to do: Upgrade to Craft CMS 4.18.6 or 5.10.13 (or later) on all affected 4.x and 5.x installations. As interim mitigation, enforce 2FA on every account (active 2FA blocks this path), consider removing system() and similar functions via PHP's disable_functions, and audit for unexpected accounts plus review login and redirect activity for signs of license-shun cookie tampering.