Read the docs
TI-2026-62447 Aliases CVE-2026-92591GHSA-fq6c-26cc-63cr

Craft CMS 5.0.0 before 5.10.13 Environment Secret Exposure via Installer

Priority LOW 36CWE-636Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning that Craft is not installed, which makes anonymous installer actions — including install/validate-site — reachable on an installed production site whenever PHP remains available but the configured MySQL endpoint does not. The action accepts a site name, serializes it through Site::getName(), and expands ${NAME} expressions using App::env(). An unauthenticated attacker who obtained a guest session cookie and matching CSRF token before the outage and whose session remains valid during it can submit a predictable variable name (for example Craft's conventional CRAFT_SECURITY_KEY) and receive its value, disclosing Craft secrets, process environment variables, $_SERVER entries, or PHP constants such as the security key, database credentials, or API keys. The issue requires an independently occurring database outage; the vulnerability itself provides no way to induce it. Fixed in 5.10.13.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00407 35th percentileScored 2026-11-07
Fix Fixed cms (craftcms): 5.10.13

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Craft CMScms5.0.0 to before 5.10.135.10.13Patch availableCNA
  • cms VendorCraft CMS Affected 5.0.0 to before 5.10.13 Fixed in 5.10.13 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*——Craft CMS
  • cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:* Versions — — ·Craft CMS

Remediation

  • Fix · CNA cms (craftcms) Fixed in 5.10.13

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    craftcms cms 5.10.13

    5 records Highest priority Priority MEDIUM 2 MEDIUM, 3 LOW

    Other records, highest priority first

    • TI-2026-62448 Craft CMS before 4.18.6 Remote Code Execution via signed cookiePriority MEDIUM 41
    • TI-2026-62449 Craft CMS 5.10.0 before 5.10.13 Authenticated Remote Code ExecutionPriority MEDIUM 40
    • TI-2026-62445 Craft CMS 5.0.0 before 5.10.13 Broken Access Control via nested-elements/reorderPriority LOW 24
    Show all 5 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-92591
  2. 2026-10-03 Alias added: GHSA-fq6c-26cc-63cr

References

Advisory 1

  • TI-2025-23503 Craft CMS Allows Remote Code Execution KEVCVSS 3.1CRITICAL 10.0
  • TI-2024-37138 RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms KEVCVSS 4.0CRITICAL 9.3
  • TI-2025-16994 Potential RCE with a compromised security key in craft/cms KEVCVSS 3.1HIGH 8.1
  • TI-2025-24595 Craft CMS stores user-provided content in session files KEVCVSS 4.0MEDIUM 6.9
  • TI-2023-22284 Craft CMS Remote Code Execution vulnerability CVSS 3.1CRITICAL 10.0
  • TI-2024-25171 Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint. CVSS 3.1CRITICAL 9.8
See all 203 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences