CVE-2026-112770 in cms
Summary
by MITRE • 10/19/2026
Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in the Twig group filter, which invokes non-string arrow arguments as callables without the checkArrow guard used by other arrow-accepting filters. Authenticated control panel users can pass an array-callable such as FileHelper::writeToFile via element-select condition rules to write a webshell to the webroot and execute code as the web user.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
Craft CMS versions 4.x prior to 4.18.8 and version 5.x prior to 5.11.0 are affected by a critical remote code execution vulnerability located within the Twig templating engine's group filter implementation. This flaw stems from an inconsistent security control mechanism where the system fails to properly validate or sanitize arguments passed as callables in specific contexts. While other arrow-accepting filters in Craft CMS utilize a checkArrow guard to ensure that only safe, string-based expressions are processed, the group filter omits this protective layer. Consequently, when authenticated users interact with element-select condition rules, they can supply an array-callable structure instead of a standard string argument. This architectural oversight allows attackers to bypass intended restrictions on executable code within the template engine context.
The operational impact of this vulnerability is severe, as it enables fully authenticated control panel users to achieve arbitrary remote code execution under the privileges of the web server process. By exploiting the lack of validation in the group filter, an attacker can construct a malicious payload that leverages PHP functions such as FileHelper::writeToFile. This capability allows the adversary to write a webshell directly into the application's public webroot directory. Once deployed, this backdoor provides persistent access and full control over the underlying server environment, facilitating data exfiltration, further lateral movement within the network, or complete system compromise depending on the configuration of the hosting infrastructure.
From a classification perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection), specifically involving the injection of executable code through improperly validated input parameters in a web application context. In terms of adversary behavior mapping to MITRE ATT&CK techniques, this exploit corresponds to T1059 Command and Scripting Interpreter for initial execution via user interaction with administrative interfaces, followed by T1505 Server Software Component such as installing or exploiting a backdoor component like the written webshell. The vulnerability highlights the importance of consistent security guard implementation across all similar functional modules within complex content management systems to prevent privilege escalation through templating engines.
Mitigation strategies require immediate action from system administrators and developers managing affected instances. The primary remediation is to upgrade Craft CMS to version 4.18.8 or later for the 4.x branch, or version 5.11.0 and later for the 5.x branch, where the checkArrow guard has been properly integrated into the group filter logic. For environments that cannot be immediately patched due to compatibility constraints, temporary mitigations should include restricting access to the control panel through IP whitelisting or multi-factor authentication to reduce the attack surface available to authenticated users. Additionally, web application firewalls can be configured to detect and block requests containing suspicious array-callable structures in element-select parameters, although this is a defensive measure rather than a fix for the underlying code defect. Regular auditing of third-party plugins and custom modules that interact with Twig filters is also recommended to ensure no similar vulnerabilities exist outside the core framework components.