Craft CMS arbitrary file read via SplFileObject in template contexts

Severity: medium · CVSS 4.5 · Published 2026-08-11

Craft CMS is a popular content management system used to build websites and manage content. An administrator with sufficient permissions can exploit a flaw in template processing to read sensitive files from the server—such as configuration files containing database credentials and security keys—by creating malicious entry type definitions. When regular users create entries under these definitions, the server exposes the sensitive file contents visible to anyone with permission to view those entries.

Technologies: craftcms/cms (Packagist). Vendors: Packagist.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Medium severity, with a CVSS score of 4.5, published 11 August 2026.
Which products and versions are affected?
craftcms/cms (Packagist) >= 4.0.0-RC1, < 4.18.2.
Is there a fix for This vulnerability?
A patch was published on 2026-08-11: Patches available: 5.10.6 and 4.18.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network.
Am I affected?
Check whether you run craftcms/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the create() Twig function (introduced in version 5.9.0), which instantiates arbitrary PHP classes but only restricts them via a 5-entry blocklist. SplFileObject, a PHP class for reading files, is not included in this blocklist. An admin can leverage this omission to construct a malicious entry type title format or URI format using create('SplFileObject', ['/path/to/file']), which reads arbitrary files when entries are created. The Twig sandbox correctly blocks create() in system email templates, so exploitation is limited to non-sandboxed contexts (entry type configurations) that require admin access and allowAdminChanges=true. The vulnerability affects versions 5.0.0-RC1 through 5.10.5 and 4.0.0-RC1 through 4.18.1; patches are available in 5.10.6 and 4.18.2.

Affected products

  • Craft CMS CMS 5.0.0-RC1 through 5.10.5, 4.0.0-RC1 through 4.18.1

Timeline

  • 2026-07-25: disclosed: Original advisory GHSA-957r-qf9p-67xw published
  • 2026-08-11: advisory: Duplicate advisory GHSA-2p2v-3mjg-gfpf published
  • 2026-08-11: patched: Patches available: 5.10.6 and 4.18.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.