EUVD-2026-56103
GHSA-2p2v-3mjg-gfpf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Admin-level authentication (PR:H) and a second user's active entry creation (UI:R) are both hard prerequisites; impact is confidentiality-only with no integrity or availability component.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
Craft CMS 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2 contain an arbitrary file read vulnerability. The create() Twig function restricts class instantiation using a 5-entry blocklist that does not include SplFileObject, allowing an authenticated administrator (with allowAdminChanges=true) to configure a malicious entry type title or URI format that instantiates SplFileObject in a non-sandboxed template context. When a user subsequently creates an entry in the affected section, arbitrary files on the server (such as .env containing the security key and database credentials) are read and rendered as entry titles.
AnalysisAI
Arbitrary file read in Craft CMS 4.x and 5.x exposes .env files, database credentials, and security keys by exploiting an incomplete blocklist in the create() Twig function that omits PHP's SplFileObject class. An authenticated administrator with allowAdminChanges=true can plant a malicious entry type title or URI format; when any user subsequently creates an entry in the affected section, the Twig renderer instantiates SplFileObject and renders the contents of arbitrary server files as entry titles. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the GitHub Security Advisory GHSA-957r-qf9p-67xw provides full technical disclosure of the technique.
Technical ContextAI
Craft CMS is a PHP-based content management system that uses the Twig templating engine. The create() helper function, introduced in Craft 5.9.0, permits instantiation of arbitrary PHP classes from Twig template code and is restricted only by a hardcoded 5-entry blocklist - an approach classified under CWE-184 (Incomplete List of Disallowed Inputs). PHP's SplFileObject (part of the Standard PHP Library) was not included in this blocklist. Craft applies Twig sandboxing to some contexts such as system email templates, correctly blocking create() there; however, entry type title formats and URI formats execute in non-sandboxed Twig contexts with full PHP class access. This architectural split - sandbox for some contexts, blocklist for others - is the structural root cause. Affected CPEs are cpe:2.3:a:craftcms:cms covering both the 4.x branch (4.0.0-RC1 through 4.18.1) and the 5.x branch (5.0.0-RC1 through 5.10.5).
RemediationAI
Upgrade Craft CMS to version 5.10.6 (v5 branch) or 4.18.2 (v4 branch); these are the vendor-released patched versions confirmed by commits 7c96fd73df936a10e8f85ae6ef61a9fc3f277c12 and 87978f11c8f986c40ef41b941d79547230c4d6d9 and documented in GHSA-957r-qf9p-67xw. For environments that cannot immediately patch, setting allowAdminChanges=false in config/general.php is the highest-value compensating control - it removes the precondition needed to plant the malicious template and aligns with Craft's recommended production posture; the trade-off is that legitimate entry type configuration changes (title format, URI format) will be blocked until the flag is re-enabled. As a detection measure, audit all entry type title format and URI format fields for presence of the create() function, particularly any invocations referencing SplFileObject. Rotating CRAFT_SECURITY_KEY and database credentials is advisable if allowAdminChanges=true was enabled in production and admin accounts may have been compromised, since .env exposure enables further privilege escalation.
Cayin CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials. Rated c
Multiple integer underflows in the icmLut_allocate function in International Color Consortium (ICC) Format library (iccl
phpKF CMS 3.00 Beta allows unauthenticated PHP file upload by disguising it as a PNG, then renaming it for execution. Po
Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 an
Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to ex
SQL injection vulnerability in hava_post.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbitr
Unrestricted file upload vulnerability in hava_upload.php in Havalite CMS 1.1.0 and earlier allows remote attackers to e
Cross-site request forgery (CSRF) vulnerability in Ilch CMS allows remote attackers to hijack the authentication of admi
Multiple cross-site scripting (XSS) vulnerabilities in Havalite 1.0.4 and earlier allow remote attackers to inject arbit
A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.
A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.
A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.
Same weakness CWE-184 – Incomplete List of Disallowed Inputs
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today