# CVE-2026-109304: Craft CMS arbitrary file read via Twig create() DOMDocument

Source: https://junglewise.ai/threats/cve-2026-109304-craft-cms-4-0-0-before-4-18-7-and-5-0-0-before-5-10-14-contains  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-109304 · Severity: medium · CVSS 4.9 · Published 2026-10-12

Craft CMS is a content management platform used to build websites and manage digital content. A vulnerability in the Twig templating engine allows attackers who can configure entry-type title formats to read arbitrary files from the server, exposing sensitive information like configuration files or credentials to non-admin users who view entries.

Technologies: [Craft CMS](https://junglewise.ai/threats/technologies/craft-cms-1). Vendors: [Craft](https://junglewise.ai/threats/vendors/craft).

## Quick answers

**Is CVE-2026-109304 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109304 being exploited in the wild.

**How severe is CVE-2026-109304?** Medium severity, with a CVSS score of 4.9, published 12 October 2026.

**Which products and versions are affected?** Craft CMS 4.0.0 before 4.18.7, 5.0.0 before 5.10.14.

**Is there a fix for CVE-2026-109304?** Yes: fixed in CMS 4.18.7, 5.10.14. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-109304 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-109304?** Check whether you run Craft CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in CMS 4.18.7, 5.10.14

## Technical details

The Twig create() function uses a blocklist to restrict instantiation of dangerous classes; however, DOMDocument was not included in this blocklist. An attacker with permission to set entry-type title formats (including via project-config/apply, which bypasses allowAdminChanges restrictions) can call create('DOMDocument').loadHTMLFile() with textContent to read arbitrary local files and expose their contents as entry titles visible to non-admin users with view permissions.

## Affected products

- Craft CMS 4.0.0 before 4.18.7, 5.0.0 before 5.10.14

## Timeline

- 2026-09-22: disclosed: GitHub Security Advisory GHSA-j5wg-m2pr-35qc published
- 2026-10-12: advisory: CVE-2026-109304 published on NVD

## References

- [https://github.com/craftcms/cms/security/advisories/GHSA-j5wg-m2pr-35qc](https://github.com/craftcms/cms/security/advisories/GHSA-j5wg-m2pr-35qc)
- [https://www.vulncheck.com/advisories/craft-cms-4.0.0-before-4.18.7-and-5.0.0-before-5.10.14-arbitrary-file-read-via-twig-create-domdocument](https://www.vulncheck.com/advisories/craft-cms-4.0.0-before-4.18.7-and-5.0.0-before-5.10.14-arbitrary-file-read-via-twig-create-domdocument)

## Related threats

- [Craft CMS SQL injection in craft.search](https://junglewise.ai/threats/cve-2026-115934-an-unauthenticated-sql-injection-can-occur-on-the-front-end-of)
- [Craft CMS authorization bypass in volume browser](https://junglewise.ai/threats/cve-2026-124431-craft-cms-from-5-10-0-before-5-11-2-contains-an-authorization)
- [Craft CMS privilege escalation in public registration](https://junglewise.ai/threats/cve-2026-124429-craft-cms-from-5-0-0-before-5-11-2-contains-a-privilege)
- [Craft CMS path traversal in app/icon-svg endpoint](https://junglewise.ai/threats/cve-2026-124428-craft-cms-from-5-7-0-before-5-11-2-contains-an-arbitrary-file)
- [Craft CMS authorization bypass in GraphQL schema scope](https://junglewise.ai/threats/cve-2026-124427-craft-cms-from-5-0-0-before-5-11-2-contains-an-authorization)