CVE-2026-72779 in Craft CMS
Summary
by MITRE • 08/11/2026
Craft CMS 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2 contain an arbitrary file read vulnerability. The create() Twig function restricts class instantiation using a 5-entry blocklist that does not include SplFileObject, allowing an authenticated administrator (with allowAdminChanges=true) to configure a malicious entry type title or URI format that instantiates SplFileObject in a non-sandboxed template context. When a user subsequently creates an entry in the affected section, arbitrary files on the server (such as .env containing the security key and database credentials) are read and rendered as entry titles.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability exists within Craft CMS versions prior to 5.10.6 and 4.18.2 where the create() Twig function implementation contains a critical security flaw in its class instantiation restrictions. The system employs a 5-entry blocklist to prevent unauthorized class instantiation, but this list fails to include SplFileObject, creating an exploitable gap that allows authenticated administrators with allowAdminChanges=true to manipulate entry type configurations. The vulnerability stems from the insufficient filtering mechanism that permits the instantiation of SplFileObject in non-sandboxed template contexts, bypassing the intended security controls.
The technical exploitation occurs when a malicious administrator configures a specially crafted entry type title or URI format that triggers SplFileObject instantiation during the entry creation process. This allows arbitrary file reading capabilities to be leveraged against the server filesystem, potentially exposing sensitive configuration files such as .env which contains critical security keys and database credentials. The vulnerability operates through the template rendering engine where the maliciously configured entry types execute the SplFileObject constructor with attacker-controlled parameters, enabling read access to any file accessible to the web server process.
The operational impact of this vulnerability is severe for organizations using affected Craft CMS versions, as it provides authenticated attackers with direct access to sensitive system information that could compromise entire infrastructure security. The attack requires only administrative privileges and allowAdminChanges=true configuration, making it particularly dangerous in environments where administrators have broad access rights. Successful exploitation can lead to complete system compromise through credential exposure, database access, and potential lateral movement within the network. This vulnerability aligns with CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and CWE-94 (Improper Control of Generation of Code) while mapping to ATT&CK technique T1566 (Phishing) through initial access via compromised admin credentials, and T1078 (Valid Accounts) for privilege escalation.
Organizations should immediately upgrade to Craft CMS versions 5.10.6 or 4.18.2 to remediate this vulnerability, ensuring that all administrators with allowAdminChanges=true have their configurations reviewed and restricted where possible. The recommended mitigation strategy includes implementing strict access controls for administrative functions, regularly auditing entry type configurations, and monitoring template rendering activities for suspicious patterns. Additionally, organizations should consider implementing network segmentation and monitoring solutions to detect anomalous file access patterns that might indicate exploitation attempts. Security teams should also conduct comprehensive vulnerability assessments of their Craft CMS installations to identify any other potential configuration issues that could be exploited in similar ways, while ensuring that all administrative accounts maintain proper least privilege principles and multi-factor authentication controls are enforced.