CVE-2026-115935

Name of the Vulnerable Software and Affected Versions Craft CMS (affected versions not specified)

Description The app/process-api-response-headers action accepts fake API response headers from any authenticated control panel user. A non-admin user with accessCp permissions can perform a CRLF injection (inserting newline characters) via the X-Craft-Plugin-Licenses header. Because the application writes this value to the .env file without removing newlines, an attacker can insert a known CRAFT SECURITY KEY. Once this key is loaded, the attacker can forge a signed login redirect that executes a Twig system() callback, leading to remote code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.