Is CVE-2026-112770 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112770 being exploited in the wild.

How severe is CVE-2026-112770?

High severity, with a CVSS score of 8.8, published 19 October 2026.

Which products and versions are affected?

Craft CMS 4.x before 4.18.8, 5.x before 5.11.0.

Is there a fix for CVE-2026-112770?

Yes: fixed in Craft CMS 4.18.8, 5.11.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-112770 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-112770?

Check whether you run Craft CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112770: Craft CMS Twig group filter remote code execution

CVE-2026-112770 · Severity: high · CVSS 8.8 · Published 2026-10-19

Craft CMS, a web content management system, contains a vulnerability in how it processes template filters. An authenticated user with control panel access can inject malicious PHP code through template rules that will be executed on the web server, allowing the attacker to run arbitrary commands as the web user and potentially take over the entire site.

Technologies: Craft CMS. Vendors: Craft.

Quick answers

Is CVE-2026-112770 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112770 being exploited in the wild.
How severe is CVE-2026-112770?: High severity, with a CVSS score of 8.8, published 19 October 2026.
Which products and versions are affected?: Craft CMS 4.x before 4.18.8, 5.x before 5.11.0.
Is there a fix for CVE-2026-112770?: Yes: fixed in Craft CMS 4.18.8, 5.11.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-112770 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-112770?: Check whether you run Craft CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Craft CMS 4.18.8, 5.11.0

Technical details

The Twig group filter fails to apply the checkArrow guard when invoking non-string callable arguments, allowing an attacker to pass array-callable syntax like ['craft\helpers\FileHelper','writeToFile'] to invoke arbitrary static methods. The vulnerability requires authenticated control panel access (gated by enableTwigSandbox=true by default, set to false) and is exploited via element-select condition rules to write a webshell to the webroot with attacker-controlled content.

Affected products

Craft CMS 4.x before 4.18.8, 5.x before 5.11.0

Timeline

2026-10-05: disclosed: GitHub advisory published
2026-10-19: advisory: NVD entry published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.