CVE-2026-112770
8.8HighPublished 19 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-94
Impact
Authenticated control panel users can execute arbitrary code as the web user by writing a webshell to the webroot. Exploitation requires network access and a valid Craft CMS control panel account.
Root cause
The Twig group filter executes non-string arrow arguments as callables without applying the checkArrow validation guard.
Affected systems
Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade Craft CMS to version 4.18.8 or 5.11.0 or later. If patching immediately is not possible, restrict control panel access to trusted internal IP addresses and revoke unnecessary control panel accounts.
$ composer update craftcms/cmsAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in the Twig group filter, which invokes non-string arrow arguments as callables without the checkArrow guard used by other arrow-accepting filters. Authenticated control panel users can pass an array-callable such as FileHelper::writeToFile via element-select condition rules to write a webshell to the webroot and execute code as the web user.