Craft CMS versions starting from 5.0.0‑RC1 up to 5.10.5 and from 4.0.0‑RC1 up to 4.18.1 allow crafted elementId parameters containing ${ENV_VAR} placeholders to be processed by Twig. The framework interpolates these placeholders into the template before rendering, even when the Twig sandbox is active. This flaw enables an attacker who can log into the control panel to inject a malicious sandboxed Twig template and, through a blind error‑based approach over multiple requests, read arbitrary environment variables and secrets. The exposed data can be used to forge sessions, elevate privileges, or steal database, SMTP, API, or blob storage credentials.

The vulnerability affects Craft CMS 5.x from 5.0.0‑RC1 to 5.10.5 and Craft CMS 4.x from 4.0.0‑RC1 to 4.18.1. Both product lines expose the flaw via the elementId parameter in the control panel.

The CVSS score is 7.1, indicating a high severity level. The EPSS score is not available and the vulnerability is not listed in CISA KEV, so it is not known to have active public exploits yet. Based on the description, it is inferred that an attacker must first gain authenticated control panel access, create an element with a crafted elementId, and then repeatedly render the template to leak environment variables incrementally via a blind error‑based technique. Once the secrets are revealed, an attacker could forge session cookies, elevate privileges, or obtain critical credentials. Given the moderate‑to‑high likelihood of exploitation once authenticated, immediate mitigation is recommended.