CVE-2026-112771 in Craft CMS
Summary
by MITRE • 10/19/2026
Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contains a Twig sandbox allowlist bypass because the column, contains, filterByValue, index, where, and multisort filters resolve caller-supplied keys via ArrayHelper::getValue() without consulting the sandbox security policy. Authenticated Control Panel users can supply dot-path keys to traverse the craft global and disclose the securityKey, database credentials, and auth tokens.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/19/2026
Craft CMS versions 4.0.0 through 4.18.8 and version 5.0.0 prior to 5.11.0 are affected by a critical Twig sandbox allowlist bypass vulnerability that stems from improper validation of user-supplied input within specific template filters. The core technical flaw lies in the implementation of several Twig filters, including column, contains, filterByValue, index, where, and multisort. These functions are designed to operate on arrays but fail to enforce the security boundaries established by the Twig sandbox policy when processing keys provided by the caller. Specifically, these filters utilize the ArrayHelper::getValue() method to resolve dot-path notation in array access operations without checking whether such traversal is permitted under the current sandbox configuration. This architectural oversight allows an attacker to bypass intended restrictions on data access within the templating engine.
The operational impact of this vulnerability is severe for any instance where authenticated users with Control Panel access can inject or manipulate template variables containing dot-path keys. By exploiting this flaw, a malicious actor can traverse object properties and array structures that are otherwise protected by the sandbox environment. This capability enables the disclosure of sensitive internal configuration data, including the application security key, database credentials stored in the system configuration, and authentication tokens used for session management or API access. The exposure of these secrets compromises the confidentiality and integrity of the entire web application infrastructure, potentially leading to full system compromise if combined with other attack vectors such as remote code execution via serialized objects using the leaked keys.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control, specifically regarding the failure to restrict access to resources based on security policies within an interpreted environment. It also maps to ATT&CK technique T1530 Data from Local System, as it involves exfiltrating sensitive configuration data and credentials directly from the application's memory or file system via template injection mechanisms. The vulnerability highlights a common pitfall in web frameworks where helper functions for array manipulation are not rigorously audited against sandboxing rules designed to prevent arbitrary code execution or information disclosure.
Mitigation strategies require immediate patching of Craft CMS to version 4.18.9 or later, and version 5.11.0 or later, which address this specific bypass by ensuring that all array access operations respect the Twig sandbox's allowlist restrictions. Administrators should verify their current installation versions through the control panel update interface or composer dependencies. In environments where immediate patching is not feasible due to operational constraints, temporary mitigations may include restricting Control Panel access to trusted users only and disabling any custom templates or plugins that utilize the affected filters with untrusted input sources. Additionally, rotating all exposed credentials such as database passwords and security keys after applying the patch is essential to eliminate potential lingering risks from prior exploitation attempts.