Secuno
ENNL
Book demo

CVE-2026-92593

8.8 HIGH
  1. Published16 Sept 2026

Description

Craft CMS versions 5.10.0 through 5.10.12 contain an incomplete fix for CVE-2026-55794: the Controller::getPostedRedirectUrl() -> View::renderObjectTemplate() sink remained unsandboxed, and the same fix commit added a self-signing oracle in Cp::elementLabelHtml(). Because Craft/Yii HMAC tokens are not bound to a parameter name, an authenticated low-privilege control panel user with edit rights on a single element type can mint a token over attacker-controlled Twig for the returnUrl parameter and replay it as the redirect POST parameter, reaching the unsandboxed sink and achieving server-side template injection that executes arbitrary PHP code (full server compromise). The issue is fixed in 5.10.13.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredLow
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-9293710.0
vm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in the…
CVE-2026-6210410.0
Unauthenticated Remote Code Execution (RCE) in Migratico Lite <= 2.6.8…
CVE-2026-887959.0
The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its…
CVE-2026-7345610.0
Under certain circumstances on affected platforms running Arista EOS with gRPC Network…
CVE-2026-921278.0
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier automatically approves…
CVE-2026-921258.8
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject the…

Frequently asked

Is CVE-2026-92593 being actively exploited?

CVE-2026-92593 is not in the CISA KEV catalog.

How severe is CVE-2026-92593?

CVE-2026-92593 has a CVSS 3.1 base score of 8.8, rated high.

How do I fix CVE-2026-92593?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-92593 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.