CVE-2026-92592 Craft CMS - Remote Code Execution

Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 contain a remote code execution caused by improper HMAC signature binding in license-shun cookie and redirect parameters, letting authenticated non-admin users execute arbitrary OS commands via unsandboxed Twig templates, exploit requires password authentication without 2FA and PHP system() availability.

CVSS base score 8.8 /10
High
CISA KEV
Not listed
Public exploit
Proof of concept available
Authentication
Required
EPSS
0.65% chance of exploitation in 30 days
View the NVD record ↗

Details

Type
Remote Code Execution
Impact
Remote Code Execution
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published
16 September 2026
Updated
15 October 2026
Weakness
CWE-1336

Vendor fix

Update to versions 4.18.6 or 5.10.13 or later.

Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them.

References

← All CVEs