CVE-2026-109304
4.9MediumPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-200
Impact
Authenticated administrators can read arbitrary local files and expose them to non-admin users who view entry titles. The attacker requires permissions to modify entry-type title formats, such as through project config changes.
Root cause
The Twig create() class blocklist omits DOMDocument, allowing invocation of loadHTMLFile() and textContent in template expressions.
Affected systems
Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Fix & remediation
Upgrade Craft CMS to 4.18.7, 5.10.14, or higher. If patching must wait, restrict administrative access to entry-type title format configurations and review pending project-config/apply changes.
$ composer require craftcms/cms:"^5.10.14" --update-with-dependenciesAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 contains an arbitrary file read vulnerability because the Twig create() class blocklist does not cover DOMDocument. Attackers able to set an entry-type title format, including via project-config/apply, can use create('DOMDocument').loadHTMLFile() with textContent to expose local file contents to non-admin users who can view entries.