Live › vulnerability › CVE-2026-112770
Go to dashboardCraft CMS 4.0.0 to before 4.18.8 and 5.0.0 to before 5.11.0: the Twig group filter calls a non-string arrow argument as a PHP callable without the checkArrow guard other filters use. A control panel user can pass an array callable such as ['craft\helpers\FileHelper','writeToFile'] through element-select condition rules and write a webshell to the webroot. The code then runs as the web user. The vendor says exploitation needs enableTwigSandbox=true (default false) and a control panel account, including lower-privilege editors.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| craftcms/cms | composer | >= 4.0.0, < 4.18.8; >= 5.0.0, < 5.11.0 | 4.18.8, 5.11.0 |
composer show craftcms/cms or ./craft --version and compare with 4.18.8 / 5.11.0enableTwigSandbox => true4.18.8 (4.x) or 5.11.0 (5.x) or later: composer update craftcms/cmsEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in the Twig group filter, which invokes non-string arrow arguments as callables without the checkArrow guard used by other arrow-accepting filters. Authenticated control panel users can pass an array-callable such as FileHelper::writeToFile via element-select condition rules to write a webshell to the webroot and execute code as the web user.
This page as .md · .json · in your agent: get_signal("CVE-2026-112770")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.