The vulnerability in Craft CMS 4.0.0-RC1 through 5.10.5 / 4.0.0-RC1 through 4.18.1 isn't just an interpolation flaw — it's a design failure where the Twig sandbox created a false security boundary that gave developers a misleading sense of protection. Environment variable interpolation executes before sandbox evaluation, meaning anything pulled from the environment during template rendering was never actually protected by sandboxing, regardless of how the feature was presented to users.
This compounds severely because the interpolated data includes CRAFT_SECURITY_KEY, the cryptographic foundation that signs user sessions, CSRF tokens, password reset hashes, and signed URLs throughout the application. Once extracted, the key enables complete account takeover — including admin sessions — effectively negating every authentication control in the system. The CVSS 6.5 score is misleading: it measures the difficulty of the extraction technique (incremental, error-based, requiring many requests) rather than the explosive outcome (total trust infrastructure compromise). An attacker with the security key isn't an 'authenticated attacker' anymore — they are indistinguishable from a legitimate administrator.
The extraction technique is worth understanding as an exploitation pattern, not just a vulnerability detail. The attacker makes many small requests, each triggering a different variable reference that fails, leaking one character at a time through error messages. Each request looks like a typo or minor user error in a logged authenticated session — normal noise that security teams aren't tuned to alert on. The signal-to-noise ratio makes detection practically impossible without pattern-correlation tooling that most Craft deployments don't have.
The immediate fix in 5.10.6/4.18.2 closes the interpolation gap, but the deeper problem is architectural: the sandbox was built to restrict template execution while environment expansion was treated as preprocessing infrastructure, never reviewed as a security boundary. These lived in different threat models, likely different pull requests, with no unified security contract. The remediation that prevents recurrence is boring but essential — formalize what 'sandboxed' actually guarantees, audit every code path that runs before sandbox evaluation, and treat environment expansion as a security-relevant operation in the threat model. Without that, the next preprocessing bypass in this pipeline will find the same gap, just deeper.