Information disclosure in Craftcms Cms

CVE-2026-55792

Craft CMS is a content management system (CMS). In versions starting from 4.0.0-RC1 and prior to 4.18.0, and 5.0.0-RC1 and above, prior to 5.10.0, the dataUrl() Twig function is included in Craft’s Twig sandbox allowlist, allowing any cont…

Vulnerability class: Information Disclosure

Affected products

  • Craftcms Cms — versions >= 4.0.0-RC1, < 4.18.0, >= 5.0.0-RC1, < 5.10.0

Weakness classification (CWE)

References