p PatchFirst

CVE-2026-112777

CVE-2026-112777 · Craft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist Bypass Leading to RCE

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its class-name checks are case-sensitive while PHP class resolution is not. Attackers with template-execution rights, such as Control Panel administrators, can instantiate SplFileObject via a lowercase class name to read .env secrets or write a PHP file into the webroot for remote code execution.

CVSS 8.7 · High · EPSS 0.5% · Fix available

Published
Updated

Affected products and versions

  • cms

    Versions
    • ≥ 4.0.0, < 4.18.8: Affected (semver)
    • 4.18.8: Not affected (semver)

    Update to 4.18.8

  • cms

    Versions
    • ≥ 5.0.0, < 5.11.0: Affected (semver)
    • 5.11.0: Not affected (semver)

    Update to 5.11.0

Original sources

Check your server →