CVE-2026-112777
7.2HighPublished 19 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-184
Impact
Authenticated attackers with template execution rights (such as Control Panel administrators) can achieve remote code execution or read secrets like .env. They need network access and high-privilege credentials on the Craft CMS instance.
Root cause
The Twig create() function uses case-sensitive blocklist checks for class names while PHP resolves classes case-insensitively, allowing blocked classes like SplFileObject to be instantiated using lowercase names.
Affected systems
Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade Craft CMS to version 4.18.8 or 5.11.0 depending on your major release. If you cannot patch immediately, restrict untrusted administrator access to the Control Panel and prevent template editing rights.
$ composer require craftcms/cms:"^4.18.8" --update-with-dependencies || composer require craftcms/cms:"^5.11.0" --update-with-dependenciesAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its class-name checks are case-sensitive while PHP class resolution is not. Attackers with template-execution rights, such as Control Panel administrators, can instantiate SplFileObject via a lowercase class name to read .env secrets or write a PHP file into the webroot for remote code execution.