CVE-2026-112777 in Craft CMS
Summary
by MITRE • 10/19/2026
Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its class-name checks are case-sensitive while PHP class resolution is not. Attackers with template-execution rights, such as Control Panel administrators, can instantiate SplFileObject via a lowercase class name to read .env secrets or write a PHP file into the webroot for remote code execution.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/19/2026
Craft CMS versions 4.x prior to 4.18.8 and version 5.x prior to 5.11.0 contain a critical security vulnerability stemming from an insufficient validation mechanism within the Twig template engine's create function. This flaw allows for a blocklist bypass that exploits the discrepancy between case-sensitive string matching used by Craft CMS and PHP’s inherent case-insensitive class resolution behavior. The core technical issue arises because the application filters specific dangerous classes based on their exact casing, yet PHP automatically normalizes class names during instantiation regardless of how they are written in code. This architectural mismatch enables an attacker to bypass security controls designed to prevent the instantiation of sensitive internal objects by utilizing alternative capitalization patterns that evade the static analysis checks implemented by the framework developers.
The operational impact of this vulnerability is severe, particularly for users with template-execution privileges such as Control Panel administrators or content editors who can inject custom Twig templates into the system. By leveraging a lowercase class name like splfileobject instead of SplFileObject, an attacker can successfully instantiate the PHP internal SplFileObject class despite it being present on the application’s blocklist. This capability allows for direct file system access beyond normal CMS boundaries. Specifically, attackers can read sensitive configuration files such as .env secrets which often contain database credentials, API keys, and encryption salts. Alternatively, they may write arbitrary PHP code into the webroot directory, leading to remote code execution with the privileges of the web server process. This effectively compromises the entire application infrastructure by granting unauthorized access to confidential data or full control over the underlying operating system through executed scripts.
From a classification perspective, this vulnerability aligns closely with CWE-78 Improper Neutralization of Special Elements used in an OS Command and CWE-94 Improper Control of Generation of Code. The root cause is categorized under CWE-20 Incorrect Processing of Input where the validation logic fails to account for case variations that are semantically equivalent but syntactically distinct according to the application's filtering rules. In terms of adversary tactics, this exploit maps directly to MITRE ATT&CK technique T1505.003 Server Side Request Forgery via Web Templates and potentially T1059 Command and Scripting Interpreter if used for further lateral movement or persistence through web shell deployment. The vulnerability highlights the risks associated with relying solely on static blocklists without implementing robust normalization strategies before validation checks occur.
Mitigation requires immediate upgrading to Craft CMS version 4.18.8 or later, which resolves this issue by ensuring that class name comparisons are case-insensitive during the filtering process. Until an upgrade is performed, administrators should restrict template execution privileges strictly to trusted users and avoid allowing user-generated content to be rendered as Twig templates without rigorous sanitization. Additionally implementing a Web Application Firewall with rules targeting common PHP object injection patterns can provide a layer of defense against exploitation attempts that attempt to bypass application-level controls through case manipulation techniques.