5 matches found
EUVD-2026-109191
The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user. A non-admin user with only accessCp can place newline characters in X-Craft-Plugin-Licenses. Craft passes this value to its .env writer without removing the newlines. Thi...
CVE-2026-115935
The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user. A non-admin user with only accessCp can place newline characters in X-Craft-Plugin-Licenses. Craft passes this value to its .env writer without removing the newlines. Thi...
CVE-2026-115935 Control panel only API response emulation replaces "securityKey" and reaches server RCE
The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user. A non-admin user with only accessCp can place newline characters in X-Craft-Plugin-Licenses. Craft passes this value to its .env writer without removing the newlines. Thi...
CVE-2026-115935
The Craft CMS control panel contains a vulnerability in the app/process-api-response-headers action, allowing authenticated users with accessCp permissions to perform Remote Code Execution (RCE) . An attacker can inject newline characters into the X-Craft-Plugin-Licenses header, which the system ...
CVE-2026-115935 Control panel only API response emulation replaces "securityKey" and reaches server RCE
The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user. A non-admin user with only accessCp can place newline characters in X-Craft-Plugin-Licenses. Craft passes this value to its .env writer without removing the newlines. Thi...