CVE-2026-112772
CVE-2026-112772 · Craft CMS 5.0.0 before 5.11.0 RCE via Asset::getMimeType Transform Injection
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox via Asset::getMimeType transforms. Attackers can supply 'as' or 'on' keys passed unfiltered to Craft::createObject, attaching malicious behaviors or event handlers that execute code as the web user.
CVSS 8.7 · High · EPSS 0.6% · Fix available
- Published
- Updated
Affected products and versions
cms
- Versions
- ≥ 5.0.0, < 5.11.0: Affected (semver)
- 5.11.0: Not affected (semver)
Update to 5.11.0