CVE-2026-55794

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.9.0 through 5.9.x

Description Control panel users with entry editing permissions can execute unsandboxed Twig code, which may lead to authenticated Remote Code Execution (RCE). The issue occurs during the entry saving process when strings for a signed redirect URL are compiled as a Twig template using the renderObjectTemplate() function instead of the sandboxed renderSandboxedObjectTemplate() alternative. This signed URL is derived from the Referer HTTP request header, which can be manipulated by an attacker.

Recommendations Update to version 5.10.0.