CVE-2026-92592: Craft CMS authenticated RCE

Proof of concept for CVE-2026-92592 / GHSA-5r92-75j8-c534. Craft signs attacker-controlled data in the authenticated license-shun cookie with the same key and format used for signed login redirects. Reusing that signed value as a redirect causes Craft to render it as unsandboxed Twig, allowing command execution through Twig's map('system') behavior.

Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 are affected. Upgrade to 4.18.6 or 5.10.13 or later. Craft 5.9.8 is affected.

Use this only against systems you own or are authorized to test.

Requirements

• Python 3
• requests
• A Craft account that uses password authentication and does not have active 2FA
• Access to the Craft Control Panel
• The default relationship between cookieValidationKey and Craft's securityKey
• system(), sh, and base64 available on the target

Create an isolated environment and install the Python package:

python3 -m venv .venv
source .venv/bin/activate
python -m pip install requests

Usage

Run the exploit with the target URL, username, password, and command:

python3 craftcms_rce.py \
  -t https://craft.example \
  -u author \
  -p 'password' \
  'id'

Command-line passwords may be visible in shell history and process listings. Use temporary test credentials. Pass --proxy for an HTTP debugging proxy and --insecure only when the target uses a certificate that cannot be verified.

Command stdout and stderr are combined and printed to stdout. Run python3 craftcms_rce.py --help for all options.

How it works

1. Fetches a CSRF token from the Control Panel login page and authenticates with the supplied account.
2. Fetches a fresh CSRF token from the Control Panel dashboard.
3. Sends a Twig payload to app/set-license-shun-cookie and captures Craft's signed cookie value.
4. Submits that value as the redirect parameter in another login request.
5. Extracts and decodes the command output from the rendered redirect.

References

• Craft CMS advisory GHSA-5r92-75j8-c534
• NVD: CVE-2026-92592