Craft CMS: Sensitive File Disclosure / Server-Side File Read

Affected versions: Craft CMS 4.x, 5.x (confirmed against 5.9.19)

The vulnerability arises from the combination of three code facts:

1. dataUrl is in the Twig sandbox allowlist
   src/config/twig-sandbox.php, line 115:
   php'allowedFunctions' => [
   ...
   'dataUrl', // ← allows file reading inside sandboxed templates
   ...
   ],

2. Html::dataUrl() does not block dotfiles
   src/helpers/Html.php, lines 1065–1090. The function applies four checks before reading a file:

Must be within the project root .env is at the root
Must not be in a system directory (config/, vendor/, storage/, templates/) .env is not
Must not be a .php file .env has no extension
File must exist .env always exists in a Craft install

There is no check for dotfiles or specifically for .env. All four checks pass silently and file_get_contents() is called, with the result returned as data:text/plain;base64,....

1. System message body is rendered via renderSandboxedString()
   src/mail/Mailer.php, lines 181–183:
   php$subject = $view->renderSandboxedString($systemMessage->subject, $variables);
   $textBody = $view->renderSandboxedString($systemMessage->body, $variables);
   $htmlBody = $view->renderSandboxedString($systemMessage->body, $variables, escapeHtml: true);

Any body content saved to a system message is executed inside the Twig sandbox when the email renders. Because dataUrl is in allowedFunctions, the sandbox policy permits its execution without restriction.

Access control: The utility:system-messages permission is a non-admin CP permission grantable to any user group via Settings > Users > Groups. It is not restricted to admins.

Vulnerability type: Sensitive File Disclosure / Server-Side File Read
Who is impacted: Any Craft CMS 4.x or 5.x installation where at least one non-admin control panel user has been granted the utility:system-messages permission, and email sending is configured.

Resources:

• https://github.com/craftcms/cms/pull/18559