Executive brief
Craft CMS is a content management system used to build and manage websites. An authenticated administrator can configure a malicious entry type title or URI format to read arbitrary files from the server, including sensitive configuration files containing database credentials and API keys. This vulnerability requires admin-level access and must be enabled via the allowAdminChanges setting, limiting exposure in properly configured production environments.
Technical details
The vulnerability exists in the create() Twig function (introduced in version 5.9.0), which instantiates arbitrary PHP classes with only a 5-entry blocklist for protection. SplFileObject is not blocklisted, allowing an attacker to instantiate it and read arbitrary files from the server filesystem. The attack requires an authenticated administrator with allowAdminChanges=true to configure a malicious template in entry type settings (title format or URI format), then any user creating an entry in that section triggers file read. The file contents are rendered as entry titles. The Twig sandbox correctly blocks create() in system email templates, so exploitation is limited to non-sandboxed admin-configured contexts. Patches are available in Craft CMS 5.10.6 and 4.18.2.
Affected products
- Craft CMS 5.0.0-RC1 before 5.10.6, 4.0.0-RC1 before 4.18.2
Timeline
- 2026-07-25: disclosed
- 2026-08-11: patched: Patches released in 5.10.6 and 4.18.2