Craft CMS EUVD-2026-104583

Requires the attacker to already possess template-execution rights in Craft CMS - in practice a Control Panel administrator or any account permitted to author/execute Twig templates. The concrete trigger is calling the Twig create() function with a lowercase (or otherwise case-varied) class name such as 'splfileobject' so PHP's case-insensitive class resolution bypasses the blocklist's case-sensitive matching. The key limiting factor is this privilege requirement: despite the official vector's PR:N, exploitation is NOT possible for remote unauthenticated attackers against a default install - the Control Panel must be reachable and the attacker must hold template-authoring capability. No user interaction by a victim is required. Affected: Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0.

This is a privilege-gated remote code execution flaw in Craft CMS, not a mass-exploitable perimeter bug. The provided CVSS 4.0 vector scores 8.7 with PR:N (no privileges required), but this DIRECTLY CONFLICTS with the description, which states exploitation requires 'template-execution rights, such as Control Panel administrators.' The PR:N rating is almost certainly wrong; this should be PR:H (or at minimum PR:L), which materially lowers real-world risk because an attacker must already hold admin-equivalent access. The provided vector also appears to under-count impact: it lists VC:H (confidentiality) only, yet the description describes writing a PHP webshell to the webroot for RCE, which is a clear integrity and availability impact (VI/VA should be H). Exploitation status is 'no public exploit identified at time of analysis' - there is no CISA KEV listing and no POC flag in the supplied data, and no EPSS score was provided to gauge exploitation probability. Net assessment: technically a high-impact RCE (full server compromise via webshell plus .env secret disclosure), but the authentication prerequisite makes it a post-authentication privilege-escalation-to-RCE issue rather than an internet-facing emergency. Priority is high for any deployment where untrusted or lower-trust users can edit/execute Twig templates; lower where Control Panel access is tightly restricted to fully-trusted administrators.

An attacker who already holds Control Panel admin rights (or otherwise can execute Twig templates) calls the Twig create() function with a lowercase class name such as 'splfileobject', which slips past the blocklist's case-sensitive checks because PHP resolves class names case-insensitively. They then use the instantiated SplFileObject to read the application's .env secrets or write a PHP file into the webroot, yielding arbitrary code execution on the server. No public exploit code was identified in the supplied data, though the technique is clearly described in the advisory.