PT-2026-97681

CVE-2026-96392

Published

2026-09-23

Updated

2026-10-22

Description by

CVSS 3.1

3.5

Low

MetricsAV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions AI CKEditor versions 0.0.0 through 1.4.3

Description Improper neutralization of special elements used in a template engine allows for code injection. The module fails to sufficiently mitigate Twig template injections in certain rules, enabling the use of Twig functions to extract confidential system data. Twig is a template engine for PHP that allows developers to generate HTML by combining static templates with dynamic data.

Recommendations Update AI CKEditor to a version later than 1.4.3.

Exploitability

Exploit

Fix

Researchers