The vulnerability allows a non-administrative user with control panel access to inject arbitrary content into the ".env" file by manipulating the X-Craft-Plugin-Licenses header. This replacement of the CRAFT_SECURITY_KEY enables forging a signed login redirect that executes arbitrary Twig system() calls, creating a remote code execution path. The weakness originates from improper validation of API response headers, a classic code injection flaw described by CWE‑94.

Craft CMS is the impacted product. Users running any version prior to the patched release that includes the security fix (available as of the 5.11.2 release) are affected. The product is identified by the cpe entry for Craft CMS. No other vendors or product variants are listed.

The CVSS score of 8.7 classifies this vulnerability as high severity. Because the exploit requires authenticated access to the control panel with the accessCp permission, an attacker must first gain user credentials or compromise a legitimate account. Once authenticated, the attacker can inject CRLF sequences in the API header, replace the security key, and trigger server-side code execution. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog at this time. Despite the lack of a publicly documented exploit, the combination of high severity, authentication requirement, and the ease of header manipulation suggests that the potential impact is considerable for organizations using older Craft CMS versions.