CVE-2026-72782
A permanent, source-backed tracker page. Values are shown only when returned; explicit gaps and read failures remain different states.
What it is
ReportedCraft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 interpolate environment variables and secrets (via ${ENV_VAR} strings in the elementId parameter) into Twig templates before rendering, even when the Twig sandbox is enabled. An authenticated attacker with control panel access can render a malicious sandboxed Twig template and, using a blind error-based technique across many requests, incrementally leak arbitrary environment variables and secrets.… Source description excerpt; complete tracked detail loads below.
Evidence: Source reported · Source: CVE record · Source last published: 2026-08-11 12:17 UTC · Source last updated: 2026-08-11 12:48 UTC · Tracker data as of: 2026-08-11 13:56 UTC
What is affected
Reportedcraftcms — cms. Product-level identification only; no affected-version conclusion is available from this field.
Evidence: Source reported · Source: CVE record · Source last published: 2026-08-11 12:17 UTC · Source last updated: 2026-08-11 12:48 UTC · Tracker data as of: 2026-08-11 13:56 UTC
Urgency and basis
ReportedTrack* · 213.9
Evidence: Tracker computed · Tracker decision tier from the evidence detailed below · Source last updated: 2026-08-11 12:48 UTC · Tracker data as of: 2026-08-11 13:56 UTC
Exploitation evidence
Not reportedNot reported by tracked sources.
What to do
ReportedA source remediation link is available. Validate that guidance against the affected product and your environment.
Source remediation ↗Evidence: Source reported · Tracked source remediation field · Source last updated: 2026-08-11 12:48 UTC · Tracker data as of: 2026-08-11 13:56 UTC
Evidence detail
Loading the full tracker evidence record…