CVE-2026-115935 Control panel only API response emulation replaces "securityKey" and reaches server RCE

The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user. A non-admin user with only accessCp can place newline characters in X-Craft-Plugin-Licenses. Craft passes this value to its .env writer without removing the newlines. Thi...

CVE-2026-115935

The Craft CMS control panel contains a vulnerability in the app/process-api-response-headers action, allowing authenticated users with accessCp permissions to perform Remote Code Execution (RCE) . An attacker can inject newline characters into the X-Craft-Plugin-Licenses header, which the system ...