Quick answers
- Is CVE-2026-109304 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-109304 being exploited in the wild.
- How severe is CVE-2026-109304?
- Medium severity, with a CVSS score of 4.9, published 12 October 2026.
- Which products and versions are affected?
- Craft CMS 4.0.0 before 4.18.7, 5.0.0 before 5.10.14.
- Is there a fix for CVE-2026-109304?
- Yes: fixed in CMS 4.18.7, 5.10.14. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-109304 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-109304?
- Check whether you run Craft CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: CMS 4.18.7, 5.10.14
Technical details
The Twig create() function uses a blocklist to restrict instantiation of dangerous classes; however, DOMDocument was not included in this blocklist. An attacker with permission to set entry-type title formats (including via project-config/apply, which bypasses allowAdminChanges restrictions) can call create('DOMDocument').loadHTMLFile() with textContent to read arbitrary local files and expose their contents as entry titles visible to non-admin users with view permissions.
Affected products
- Craft CMS 4.0.0 before 4.18.7, 5.0.0 before 5.10.14
Timeline
- 2026-09-22: disclosed: GitHub Security Advisory GHSA-j5wg-m2pr-35qc published
- 2026-10-12: advisory: CVE-2026-109304 published on NVD