CVE-2026-92593

Craft CMS 5.10.0 through 5.10.12 contain an incomplete fix for CVE-2026-55794: the control-panel redirect handler (Controller::getPostedRedirectUrl()) still feeds attacker-influenced input into the unsandboxed View::renderObjectTemplate() sink. Because Craft/Yii HMAC tokens are not bound to a parameter name, and the same fix commit introduced a self-signing oracle in Cp::elementLabelHtml(), an authenticated low-privilege control-panel user with edit rights on just a single element type can mint a valid token over attacker-controlled Twig for the returnUrl parameter and replay it as the redirect POST parameter. Reaching the unsandboxed sink yields server-side template injection that executes arbitrary PHP code, resulting in full server compromise. Any Craft CMS deployment running 5.10.0-5.10.12 is affected, including sites where untrusted users hold edit permission on any one element type. No public proof-of-concept is known and the flaw is not in CISA's KEV, so exploitation has not been confirmed.

What to do: Upgrade to Craft CMS 5.10.13 or later immediately. Until patched, restrict control-panel access to trusted users and review accounts with element edit permissions, since edit rights on a single element type are sufficient to exploit. Check logs for unusual returnUrl/redirect token replay and inspect the host for signs of unexpected PHP execution or webshells.