CVE-2026-112772

8.8High

Published 19 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

8.8High

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-94

Impact

Authenticated Control Panel users can execute arbitrary code on the server as the web application user. They need valid credentials to access the Craft CMS Control Panel.

Root cause

The Asset::getMimeType method passes unfiltered 'as' and 'on' keys to Craft::createObject, allowing users to escape the Twig sandbox by attaching arbitrary behaviors or event handlers.

Affected systems

Craft CMS 5.0.0 before 5.11.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade Craft CMS to version 5.11.0 or later. If upgrading immediately is not possible, restrict Control Panel access to strictly trusted internal networks and accounts.

shell

$ composer update craftcms/cms --with-dependencies

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox via Asset::getMimeType transforms. Attackers can supply 'as' or 'on' keys passed unfiltered to Craft::createObject, attaching malicious behaviors or event handlers that execute code as the web user.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-112772