Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-controlled license-shun cookie with the same key and format used to validate signed redirect parameters, because the HMAC signature is not bound to its purpose (Yii's cookieValidationKey is derived from the same Craft securityKey used for signed request parameters). An authenticated, non-administrator user (Control Panel access is not required) can set the cookie via the license-shun endpoint and transplant the signed envelope into the redirect parameter; on a successful login, Craft validates the signature and renders the authenticated bytes as an unsandboxed Twig template, where Twig's map filter accepts a string callback and allows PHP system() to execute arbitrary operating-system commands as the web-server user. Exploitation requires an account using password authentication without active 2FA, the default request configuration, and availability of PHP system(). The issue is fixed in 4.18.6 and 5.10.13.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-09-16 | 1 | Disclosure1 |
| 2026-10-05 | 1 | PoC1 |
csirt_it: ‼️ #CraftCMS: Proof of Concept (#PoC) per lo sfruttamento della vulnerabilità CVE-2026-92592 risulta disponibile in rete Rischio: 🔴 ⚠ Ove non provveduto, si raccomanda l’aggiornamento tempestivo del software interessato https://x.com/csirt_it/status/2100522438618382544
Post summary
The tweet warns that a Proof of Concept for CVE-2026-92592 is available online and recommends updating the affected software.
CVE-2026-92592 Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-controlled license-shun cookie with the same key and format used to val… https://www.cve.org/CVERecord?id=CVE-2026-92592
Post summary
The tweet discloses that Craft CMS versions 4.8.0–4.18.5 and 5.0.0–5.10.12 incorrectly sign an attacker‑controlled license‑shun cookie with the same key and format used for validation, revealing a potential authentication or privilege‑escalation flaw.