Craft CMS arbitrary file read via SplFileObject in Twig templates

Executive brief

Craft CMS, a popular content management system, contains a vulnerability that allows administrative users to read sensitive files from the underlying server. By exploiting this, an attacker with administrative access could steal database credentials, security keys, and other configuration secrets. This risk is primarily present in development or staging environments where administrative configuration changes are permitted.

Technical details

The `create()` Twig function, introduced in Craft CMS 5.9.0, allows the instantiation of arbitrary PHP classes. While a blocklist exists to prevent abuse, it failed to include `SplFileObject`, which can be used to read local files. An attacker with administrative privileges can exploit this in non-sandboxed contexts, such as entry type title or URI formats, provided the `allowAdminChanges` setting is set to true. This allows for the disclosure of sensitive files like `.env` or `/etc/passwd`. The vulnerability is addressed in versions 4.18.2 and 5.10.6.

Affected products

• Pixel & Tonic Craft CMS >= 4.0.0-RC1, < 4.18.2; >= 5.0.0-RC1, < 5.10.6

Timeline

• 2026-07-25: disclosed: Initial disclosure by reporter
• 2026-08-06: advisory: GitHub Advisory published
• 2026-08-06: patched: Fixes released in versions 4.18.2 and 5.10.6

References

• https://api.github.com/users/je-lv
• https://github.com/je-lv
• https://api.github.com/users/je-lv/gists%7B/gist_id%7D
• https://api.github.com/users/je-lv/repos
• https://avatars.githubusercontent.com/u/40743233?v=4
• https://api.github.com/users/je-lv/events%7B/privacy%7D