CVE-2026-55794: Craft CMS Authenticated Remote Code Execution via Referrer Redirect
Summary
CVE-2026-55794: Craft CMS: Potential authenticated Remote Code Execution via referrer redirect. Affects craftcms/cms versions >= 5.9.0, < 5.10.0. Fixed in 5.10.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Craft CMS is a flexible content management system designed for developers and designers, enabling them to create custom websites and applications. It offers a user-friendly control panel, robust templating capabilities, and a rich ecosystem of plugins. However, it is susceptible to vulnerabilities that can compromise its security, such as the one described here, which allows authenticated users to execute arbitrary code.
Vulnerability Detail
The vulnerability arises from the way Craft CMS handles the HTTP Referrer header when saving entries. Users with control panel access and permissions to edit entries can inject unsandboxed Twig code through this header. The method renderObjectTemplate() is used to compile the signed redirect URL, which is user-controlled, instead of the safer renderSandboxedObjectTemplate(). This oversight can lead to remote code execution, allowing attackers to execute malicious code on the server.
How To Fix
Minimum fixed version
5.10.0
This is the first release that contains the fix.
composer require craftcms/cms:5.10.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the control panel for users who do not need to edit entries, thereby minimizing the risk of exploitation until the update can be applied.
Conclusion
In summary, CVE-2026-55794 is a significant vulnerability in Craft CMS that allows authenticated users to execute remote code through the HTTP Referrer header. It is crucial for affected users to update to version 5.10.0 or higher to mitigate this risk. Additionally, using Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for craftcms/cms →
FAQ
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
Any user with control panel access and permissions to edit entries in Craft CMS versions 5.9.0 to 5.9.x is affected.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update immediately, consider restricting access to the control panel for users who do not need to edit entries as a temporary measure.
More information can be found in the GitHub pull request linked in the vulnerability details: https://github.com/craftcms/cms/pull/18680.
References
Related vulnerabilities
Recent vulnerabilities recorded for craftcms/cms.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
