EUVD-2026-56103
GHSA-2p2v-3mjg-gfpf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Admin-level authentication (PR:H) and a second user's active entry creation (UI:R) are both hard prerequisites; impact is confidentiality-only with no integrity or availability component.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
Craft CMS 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2 contain an arbitrary file read vulnerability. The create() Twig function restricts class instantiation using a 5-entry blocklist that does not include SplFileObject, allowing an authenticated administrator (with allowAdminChanges=true) to configure a malicious entry type title or URI format that instantiates SplFileObject in a non-sandboxed template context. When a user subsequently creates an entry in the affected section, arbitrary files on the server (such as .env containing the security key and database credentials) are read and rendered as entry titles.
AnalysisAI
Arbitrary file read in Craft CMS 4.x and 5.x exposes .env files, database credentials, and security keys by exploiting an incomplete blocklist in the create() Twig function that omits PHP's SplFileObject class. An authenticated administrator with allowAdminChanges=true can plant a malicious entry type title or URI format; when any user subsequently creates an entry in the affected section, the Twig renderer instantiates SplFileObject and renders the contents of arbitrary server files as entry titles. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Craft CMS administrator account (high-privilege access to the control panel) with the ability to edit entry type settings, specifically the title format or URI format fields. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 vector (PR:N/UI:N) is materially inconsistent with the described exploitation conditions, which require admin-level control panel access and the non-default allowAdminChanges=true configuration - this discrepancy likely represents a scoring error and should not be used for prioritization. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A rogue or compromised Craft CMS administrator navigates to Settings > Entry Types and edits a high-traffic section's title format to include create('SplFileObject', ['/var/www/html/.env']) within the Twig template. When a content editor subsequently creates or saves any entry in that section, Craft's non-sandboxed Twig renderer instantiates SplFileObject, reads the .env file line-by-line, and renders the file contents as the entry's title - exposing CRAFT_SECURITY_KEY, database host/credentials, and API secrets to any user who can view entries in that section. … |
| Remediation | Upgrade Craft CMS to version 5.10.6 (v5 branch) or 4.18.2 (v4 branch); these are the vendor-released patched versions confirmed by commits 7c96fd73df936a10e8f85ae6ef61a9fc3f277c12 and 87978f11c8f986c40ef41b941d79547230c4d6d9 and documented in GHSA-957r-qf9p-67xw. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit Craft CMS 4.x/5.x deployments to identify instances and enumerate administrators with allowAdminChanges=true; immediately rotate all database credentials, API keys, and secrets stored in .env files. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Cayin CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials. Rated c
Multiple integer underflows in the icmLut_allocate function in International Color Consortium (ICC) Format library (iccl
phpKF CMS 3.00 Beta allows unauthenticated PHP file upload by disguising it as a PNG, then renaming it for execution. Po
Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 an
Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to ex
SQL injection vulnerability in hava_post.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbitr
Unrestricted file upload vulnerability in hava_upload.php in Havalite CMS 1.1.0 and earlier allows remote attackers to e
Cross-site request forgery (CSRF) vulnerability in Ilch CMS allows remote attackers to hijack the authentication of admi
Multiple cross-site scripting (XSS) vulnerabilities in Havalite 1.0.4 and earlier allow remote attackers to inject arbit
A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.
A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.
A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.
Same weakness CWE-184 – Incomplete List of Disallowed Inputs
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today