CVE-2026-115935 | Craft CMS up to 4.18.8/5.11.1 Process API Response Headers system X-Craft-Plugin-Licenses crlf injection

October 23, 2026 Yanac

A vulnerability described as critical has been identified in Craft CMS up to 4.18.8/5.11.1. Impacted is the function system of the component Process API Response Headers. Executing a manipulation of the argument X-Craft-Plugin-Licenses can lead to crlf injection.

This vulnerability is handled as CVE-2026-115935. The attack can be executed remotely. There is not any exploit available.

Upgrading the affected component is recommended.VulDB Recent EntriesRead More