Executive brief
Craft CMS is a popular content management system used to build websites and manage content. An administrator with sufficient permissions can exploit a flaw in template processing to read sensitive files from the server—such as configuration files containing database credentials and security keys—by creating malicious entry type definitions. When regular users create entries under these definitions, the server exposes the sensitive file contents visible to anyone with permission to view those entries.
Technical details
The vulnerability exists in the create() Twig function (introduced in version 5.9.0), which instantiates arbitrary PHP classes but only restricts them via a 5-entry blocklist. SplFileObject, a PHP class for reading files, is not included in this blocklist. An admin can leverage this omission to construct a malicious entry type title format or URI format using create('SplFileObject', ['/path/to/file']), which reads arbitrary files when entries are created. The Twig sandbox correctly blocks create() in system email templates, so exploitation is limited to non-sandboxed contexts (entry type configurations) that require admin access and allowAdminChanges=true. The vulnerability affects versions 5.0.0-RC1 through 5.10.5 and 4.0.0-RC1 through 4.18.1; patches are available in 5.10.6 and 4.18.2.
Affected products
- Craft CMS CMS 5.0.0-RC1 through 5.10.5, 4.0.0-RC1 through 4.18.1
Timeline
- 2026-07-25: disclosed: Original advisory GHSA-957r-qf9p-67xw published
- 2026-08-11: advisory: Duplicate advisory GHSA-2p2v-3mjg-gfpf published
- 2026-08-11: patched: Patches available: 5.10.6 and 4.18.2