CVE-2026-112772 in Craft CMS
Summary
by MITRE • 10/19/2026
Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox via Asset::getMimeType transforms. Attackers can supply 'as' or 'on' keys passed unfiltered to Craft::createObject, attaching malicious behaviors or event handlers that execute code as the web user.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
Craft CMS versions prior to 5.11.0 contain a critical remote code execution vulnerability within the Control Panel interface, specifically affecting authenticated users who possess permissions to manage assets. This flaw stems from an improper validation of input parameters passed through Asset::getMimeType transforms. While Craft CMS utilizes Twig as its templating engine and employs a sandboxing mechanism intended to restrict dangerous operations during template rendering, this specific vector allows attackers to bypass those security controls entirely. The vulnerability arises because certain keys within the transform configuration array are not adequately sanitized before being processed by internal object creation methods.
The technical root cause lies in how Craft::createObject handles dynamic property assignment and event attachment. When an authenticated user submits a request containing specially crafted asset transforms, they can inject specific associative array keys such as 'as' or 'on'. These keys correspond to Twig's syntax for attaching behaviors or events to objects. Because these inputs are passed directly into the object instantiation process without sufficient filtering, an attacker can effectively attach malicious PHP event handlers or behaviors to system objects. This mechanism allows arbitrary code execution within the context of the web server user account, which typically has read and write access to the application's files and database.
From a classification perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) and CWE-78 Improper Neutralization of Special Elements used in an OS Command (OS Command Injection), depending on the specific payload utilized by the attacker. In terms of the MITRE ATT&CK framework, this exploit maps to T1059 Command and Scripting Interpreter, specifically leveraging PHP execution capabilities within a web application context. The attack vector is classified as Network-based with Authentication Required, meaning that while it can be triggered remotely over HTTP/HTTPS, it necessitates valid credentials for an account with asset management privileges.
The operational impact of this vulnerability is severe, resulting in full system compromise on the affected server. An attacker who successfully exploits this flaw gains the ability to execute arbitrary PHP code, read sensitive configuration files including database credentials, modify or delete content within the CMS, and potentially pivot further into the internal network if the web server has broader access rights. Since Craft CMS is often used for high-profile websites and digital experiences, such a compromise can lead to significant data breaches, defacement, and loss of customer trust. The vulnerability affects all installations running version 5.0.0 through 5.10.x, making it a widespread risk across the ecosystem until patches are applied.
Mitigation strategies must prioritize immediate patching as the primary defense vector. Administrators should upgrade Craft CMS to version 5.11.0 or later, where this input validation issue has been resolved by properly sanitizing and restricting the keys allowed in transform configurations. In environments where upgrading is not immediately feasible due to compatibility constraints with third-party plugins or custom code, temporary mitigations include enforcing strict role-based access control (RBAC) policies. Limiting asset management permissions to only those users who absolutely require them reduces the attack surface significantly. Additionally, deploying a Web Application Firewall can help detect and block requests containing suspicious patterns associated with Twig sandbox escape attempts, although this is not a substitute for patching the underlying code flaw. Regular security audits and penetration testing should also be conducted to identify any other potential misconfigurations in the CMS environment that could facilitate similar attacks.