# CVE-2026-72779: Craft CMS arbitrary file read via SplFileObject in Twig create()

Source: https://junglewise.ai/threats/cve-2026-72779-craft-cms-arbitrary-file-read-via-splfileobject-in-twig-create  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-11. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-72779 · Severity: medium · CVSS 4.5 · Published 2026-08-11

Craft CMS is a content management system used to build and manage websites. An authenticated administrator can configure a malicious entry type title or URI format to read arbitrary files from the server, including sensitive configuration files containing database credentials and API keys. This vulnerability requires admin-level access and must be enabled via the allowAdminChanges setting, limiting exposure in properly configured production environments.

Technologies: [craftcms/cms (Packagist)](https://junglewise.ai/threats/technologies/craftcms-cms). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-72779 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-72779 being exploited in the wild.

**How severe is CVE-2026-72779?** Medium severity, with a CVSS score of 4.5, published 11 August 2026.

**Which products and versions are affected?** craftcms/cms (Packagist) ECOSYSTEM:introduced=5.0.0-RC1,fixed=5.10.6.

**Is there a fix for CVE-2026-72779?** Yes. craftcms/cms (Packagist): upgrade to 5.10.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-72779 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-72779?** Check whether you run craftcms/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- craftcms/cms (Packagist): upgrade to 5.10.6 or later

  ```sh
  composer require craftcms/cms:^5.10.6
  ```


## Technical details

The vulnerability exists in the create() Twig function (introduced in version 5.9.0), which instantiates arbitrary PHP classes with only a 5-entry blocklist for protection. SplFileObject is not blocklisted, allowing an attacker to instantiate it and read arbitrary files from the server filesystem. The attack requires an authenticated administrator with allowAdminChanges=true to configure a malicious template in entry type settings (title format or URI format), then any user creating an entry in that section triggers file read. The file contents are rendered as entry titles. The Twig sandbox correctly blocks create() in system email templates, so exploitation is limited to non-sandboxed admin-configured contexts. Patches are available in Craft CMS 5.10.6 and 4.18.2.

## Affected products

- Craft CMS 5.0.0-RC1 before 5.10.6, 4.0.0-RC1 before 4.18.2

## Identifiers

- CVE-2026-72779
- GHSA-957r-qf9p-67xw

## Timeline

- 2026-07-25: disclosed
- 2026-08-11: patched: Patches released in 5.10.6 and 4.18.2

## References

- [https://github.com/craftcms/cms/security/advisories/GHSA-957r-qf9p-67xw](https://github.com/craftcms/cms/security/advisories/GHSA-957r-qf9p-67xw)
- [https://www.vulncheck.com/advisories/craft-cms-rc1-before-arbitrary-file-read-via-splfileobject](https://www.vulncheck.com/advisories/craft-cms-rc1-before-arbitrary-file-read-via-splfileobject)

## Related threats

- [Craft CMS: Stored XSS in the control panel via unescaped draft name](https://junglewise.ai/threats/cve-2026-72787-craft-cms-stored-xss-in-the-control-panel-via-unescaped-draft)
- [Craft CMS: Arbitrary user password reset leading to administrator account takeover](https://junglewise.ai/threats/cve-2026-72786-craft-cms-arbitrary-user-password-reset-leading-to-administrator)
- [Craft CMS authorization bypass in category structure modification](https://junglewise.ai/threats/craft-cms-authorization-bypass-in-category-structure-modification-1555f980)
- [Craft CMS authenticated RCE through Twig sandbox escape](https://junglewise.ai/threats/craft-cms-authenticated-rce-through-twig-sandbox-escape-32ee5ec1)
- [Craft CMS path traversal in ensurePathIsContained](https://junglewise.ai/threats/craft-cms-path-traversal-in-ensurepathiscontained-4adc3058)