Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Craft CMS is a content management system (CMS). In versions starting from 4.0.0-RC1 and prior to 4.18.0, and 5.0.0-RC1 and above, prior to 5.10.0, the dataUrl() Twig function is included in Craft’s Twig sandbox allowlist, allowing any control panel user granted the utility:system-messages permission to embed a file-reading payload into system email templates. When those emails are sent, the server reads the target file and returns its contents as a base64-encoded data URL embedded in the email body. The .env file, which typically contains the database password, CRAFT_SECURITY_KEY, and third-party API keys, passes all of Craft’s existing dataUrl() protection checks and is fully exfiltrated. Obtaining CRAFT_SECURITY_KEY enables an attacker to forge session tokens and escalate to full admin account takeover. This issue has been fixed in versions 4.18.0 and 5.10.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-55792 Craft CMS is a content management system (CMS). In versions starting from 4.0.0-RC1 and prior to 4.18.0, and 5.0.0-RC1 and above, prior to 5.10.0, the dataUrl() Twig … https://www.cve.org/CVERecord?id=CVE-2026-55792
Post summary
The snippet merely lists CVE-2026-55792 for Craft CMS and links to its CVE record, without any details on exploitation, patches, or technical aspects.
🚨*CVE* CVE-2026-55792 Craft CMS is a content management system (CMS). In versions starting from 4.0.0-RC1 and prior to 4.18.0, and 5.0.0-RC1 and above, prior to 5.10.0, the dataUrl() Twig … https://www.cve.org/CVERecord?id=CVE-2026-55792 ----- Traducción: CVE-2026-55792 Cra… http://infoflow.cloud`
Post summary
The tweet references CVE-2026-55792 for Craft CMS and lists affected version ranges, but provides no proof of concept, exploit code, active exploitation data, patch information, or detailed technical specifics.
CVE-2026-55792 Arbitrary File Read in Craft CMS via Twig dataUrl() Function Sand... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-55792 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
CVE-2026‑55792 is an arbitrary file read vulnerability in Craft CMS’s Twig dataUrl() function, announced via a brief Vulmon alert with no details on patches, exploits, or PoC.