Craft CMS EUVD-2026-97606

Requires the attacker to control an entry-type title format - specifically the ability to set it directly or to push configuration via project-config/apply - which is a high-privilege/configuration-level capability (PR:H), not anonymous access. The exploit depends on Craft's Twig create() blocklist omitting DOMDocument, letting create('DOMDocument').loadHTMLFile() plus textContent read local files. A key limiting factor is that this is only impactful in multi-role deployments where the configuring user is distinct from, and more privileged than, the non-admin entry-viewing users who ultimately receive the leaked contents; in a single trusted-admin install the trust boundary is not meaningfully crossed. Impact is confined to confidentiality (arbitrary local file read); no integrity or availability effect.

This is a moderate-priority information-disclosure flaw, not a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, VC:H) scores 6.9 and tells a consistent story: network-reachable and low-complexity, but gated behind PR:H - the attacker must already hold high privileges (the ability to configure an entry-type title format, including via project-config/apply). The real-world risk therefore hinges on an operator/configuration-level trust boundary rather than anonymous internet exposure. No EPSS score, no CISA KEV listing, and no public POC were provided, so by the precision rules this is 'no public exploit identified at time of analysis' - there is no evidence of active exploitation or widespread automation. The signals are internally consistent (no CVSS-vs-description conflict): the description's requirement to 'set an entry-type title format' matches PR:H, and the impact is purely confidentiality (VI:N/VA:N) matching CWE-200. The notable nuance is that a high-privileged configurer uses the flaw to leak file contents to LOWER-privileged users (non-admin users who can view entries), so this is really a privilege-boundary bypass within a multi-tenant/multi-role Craft install. Priority should be elevated for environments where content editors or integrators do not fully trust the server's local filesystem; for single-admin deployments the practical risk is low.

In a Craft CMS install with multiple roles, a user who can edit entry-type settings (or push a malicious project-config/apply) sets an entry-type title format containing create('DOMDocument').loadHTMLFile() with textContent pointing at a sensitive server file. When non-admin users then view affected entries, the rendered title discloses the local file's contents to them. No public exploit code was identified at time of analysis, and because PR:H is required, the attacker must already hold configuration-level access.