Craft CMS allows users with the utility:system-messages permission to embed arbitrary dataUrl() Twig function payloads into system email templates. Because dataUrl() was mistakenly included in the Twig sandbox allowlist, the server reads the specified file and returns its contents as a URL in the email body. The .env file, which stores the database credentials, CRAFT_SECURITY_KEY, and third‑party API keys, passes all existing protection checks and is fully exfiltrated. This is a sensitive file disclosure flaw identified as CWE-200, and possession of the CRAFT_SECURITY_KEY allows an attacker to forge session tokens and take full administrative control of the site.

The flaw affects Craft CMS 4.0.0-RC1 through 4.17.x and 5.0.0-RC1 through 5.9.x. 4.18.0 and 5.10.0, where dataUrl .env file no longer can be read via email templates.

The CVSS base score is 6, indicating moderate severity. The EPSS score is <1%, pointing to a very low likelihood of exploitation in the wild. This vulnerability is not listed in the CISA KEV catalog. An attacker would need an authenticated control panel user with the utility:system-messages permission to embed a malicious payload; this user could then read arbitrary files, exfiltrate the .env contents, and if the CRAFT_SECURITY_KEY is compromised, forge session tokens to achieve full admin takeover. In environments where the permission is tightly controlled, the risk is lowered, but the possibility of critical deployments.