{"id":"CVE-2026-112770","kind":"vulnerability","aliases":["CVE-2026-112770"],"related":[],"title":"Craft CMS: Twig filter lets control panel users run code on server","description":"Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in the Twig group filter, which invokes non-string arrow arguments as callables without the checkArrow guard used by other arrow-accepting filters. Authenticated control panel users can pass an array-callable such as FileHelper::writeToFile via element-select condition rules to write a webshell to the webroot and execute code as the web user.","summary":"Craft CMS 4.0.0 to before 4.18.8 and 5.0.0 to before 5.11.0: the Twig group filter calls a non-string arrow argument as a PHP callable without the checkArrow guard other filters use. A control panel user can pass an array callable such as ['craft\\helpers\\FileHelper','writeToFile'] through element-select condition rules and write a webshell to the webroot. The code then runs as the web user. The vendor says exploitation needs enableTwigSandbox=true (default false) and a control panel account, including lower-privilege editors.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"craftcms/cms","fixed":["4.18.8","5.11.0"],"affected":">= 4.0.0, < 4.18.8; >= 5.0.0, < 5.11.0","ecosystem":"composer"}],"ecosystems":[],"tags":["composer","craft-cms","package","php","rce","self-hosted"],"not_affected_if":["control-panel-users-trusted","enabletwigsandbox-false","no-control-panel-access","not-on-affected-versions"],"how_to_check":"Run 'composer show craftcms/cms' or './craft --version' and compare with 4.18.8 / 5.11.0. Then check config/general.php for 'enableTwigSandbox' => true. The vendor says the bug is only reachable when it is true; the default is false. Look in the webroot for unexpected .php files and in access logs for odd control panel requests.","fix":"Upgrade craftcms/cms to 4.18.8 (4.x) or 5.11.0 (5.x) or later: 'composer update craftcms/cms'. The vendor lists no workaround. Until you upgrade, limit control panel accounts to trusted users and make the webroot non-writable by the web user.","status":"open","published_at":"2026-10-19T20:17:54+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-23T22:33:05+00:00","updated_at":"2026-10-24T00:20:19+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-23T22:33:05Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Craft CMS 4.x to 4.18.8 or later, or 5.x to 5.11.0 or later.","reach":"internet","title":"Craft CMS: Twig filter lets control panel users run code on server","impact":"high","summary":"Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 let an authenticated control panel user pass an array callable through a Twig group filter and element-select condition rules. An attacker can write a webshell into the webroot and execute code as the web server user.","category":"package","who_cares":["craft-cms","php","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Code runs as the web user; webshell written to the webroot","analyst_note":"Confirm the exact installed version check and whether a workaround exists before 4.18.8/5.11.0 (NVD page linked in sources).","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["control-panel-users-trusted","not-on-affected-versions"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000495,"input_tokens":2973,"output_tokens":395,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the exact installed version check and whether a workaround exists before 4.18.8/5.11.0 (NVD page linked in sources).","search":"'-112770':15A,18A '-2026':14A,17A '4':120C '4.0.0':32B '4.18.8':35B,123C '5':125C '5.0.0':37B '5.11.0':40B,128C 'accept':158C 'account':112B 'argument':51B,146C 'array':70B,168C 'array-cal':167C 'arrow':50B,145C,157C 'arrow-accept':156C 'authent':160C 'call':45B 'callabl':55B,71B,148C,169C 'checkarrow':58B,151C 'cms':2A,23B,31B,119C 'code':10A,92B,132C,189C 'compos':20B 'condit':82B,178C 'contain':129C 'control':6A,64B,110B,161C 'craft':1A,22B,30B,74B,118C 'craft-cm':21B 'craftcms/cms':19A 'cve':13A,16A 'default':106B 'editor':117B 'element':80B,176C 'element-select':79B,175C 'enabletwigsandbox':104B 'execut':133C,188C 'exploit':102B 'fals':107B 'filehelp':76B,172C 'filter':4A,44B,61B,139C,159C 'group':43B,138C 'guard':59B,152C 'helper':75B 'host':29B 'includ':113B 'invok':141C 'let':5A 'lower':115B 'lower-privileg':114B 'need':103B 'non':48B,143C 'non-str':47B,142C 'packag':24B 'panel':7A,65B,111B,162C 'pass':68B,165C 'php':25B,54B 'privileg':116B 'rce':26B 'remot':131C 'rule':83B,179C 'run':9A,94B 'say':101B 'select':81B,177C 'self':28B 'self-host':27B 'server':12A 'string':49B,144C 'true':105B 'twig':3A,42B,137C 'use':62B,153C 'user':8A,66B,98B,163C,193C 'vendor':100B 'via':174C 'vulner':134C 'web':97B,192C 'webroot':90B,186C 'webshel':87B,183C 'without':56B,149C 'write':85B,181C 'writetofil':77B,173C 'x':121C,126C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T20:17:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112770","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112770","severity":null,"published_at":"2026-10-19T20:17:54+00:00","modified_at":"2026-10-22T21:17:15+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112770:639","url":null,"severity":null,"published_at":"2026-10-24T00:20:19+00:00","modified_at":"2026-10-24T00:20:19+00:00","first_seen_at":"2026-10-24T00:20:19+00:00","fetched_at":"2026-10-24T00:20:19+00:00","note":"Read vendor GHSA-xmwr-88vw-5ghh and CVE record. Key finding: the advisory says reachable only with enableTwigSandbox=true (default false) plus control panel login. GHSA lists '<= 4.18.8' but patched 4.18.8; CVE says before 4.18.8, so I used that. No public PoC or exploitation found. No X posts. No vendor workaround; the interim steps below are my inference."}],"documents":[{"id":2550,"url":"https://github.com/craftcms/cms/security/advisories/GHSA-xmwr-88vw-5ghh","title":"GHSA-xmwr-88vw-5ghh: Authenticated RCE via Twig group filter array-callable","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2551,"url":"https://www.cve.org/CVERecord?id=CVE-2026-112770","title":"CVE Record CVE-2026-112770","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}