Is CVE-2026-72779 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-72779 being exploited in the wild.

How severe is CVE-2026-72779?

Medium severity, with a CVSS score of 4.5, published 11 August 2026.

Which products and versions are affected?

craftcms/cms (Packagist) ECOSYSTEM:introduced=5.0.0-RC1,fixed=5.10.6.

Is there a fix for CVE-2026-72779?

Yes. craftcms/cms (Packagist): upgrade to 5.10.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-72779 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-72779?

Check whether you run craftcms/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-72779: Craft CMS arbitrary file read via SplFileObject in Twig create()

CVE-2026-72779 · Severity: medium · CVSS 4.5 · Published 2026-08-11

Craft CMS is a content management system used to build and manage websites. An authenticated administrator can configure a malicious entry type title or URI format to read arbitrary files from the server, including sensitive configuration files containing database credentials and API keys. This vulnerability requires admin-level access and must be enabled via the allowAdminChanges setting, limiting exposure in properly configured production environments.

Technologies: craftcms/cms (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-72779 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-72779 being exploited in the wild.
How severe is CVE-2026-72779?: Medium severity, with a CVSS score of 4.5, published 11 August 2026.
Which products and versions are affected?: craftcms/cms (Packagist) ECOSYSTEM:introduced=5.0.0-RC1,fixed=5.10.6.
Is there a fix for CVE-2026-72779?: Yes. craftcms/cms (Packagist): upgrade to 5.10.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-72779 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-72779?: Check whether you run craftcms/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

craftcms/cms (Packagist): upgrade to 5.10.6 or later
```
composer require craftcms/cms:^5.10.6
```

Technical details

The vulnerability exists in the create() Twig function (introduced in version 5.9.0), which instantiates arbitrary PHP classes with only a 5-entry blocklist for protection. SplFileObject is not blocklisted, allowing an attacker to instantiate it and read arbitrary files from the server filesystem. The attack requires an authenticated administrator with allowAdminChanges=true to configure a malicious template in entry type settings (title format or URI format), then any user creating an entry in that section triggers file read. The file contents are rendered as entry titles. The Twig sandbox correctly blocks create() in system email templates, so exploitation is limited to non-sandboxed admin-configured contexts. Patches are available in Craft CMS 5.10.6 and 4.18.2.

Affected products

Craft CMS 5.0.0-RC1 before 5.10.6, 4.0.0-RC1 before 4.18.2

Identifiers

CVE-2026-72779
GHSA-957r-qf9p-67xw

Timeline

2026-07-25: disclosed
2026-08-11: patched: Patches released in 5.10.6 and 4.18.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.