---
id: "CVE-2026-112770"
kind: "vulnerability"
aliases: ["CVE-2026-112770"]
title: "Craft CMS: Twig filter lets control panel users run code on server"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "craftcms/cms", "fixed": ["4.18.8", "5.11.0"], "affected": ">= 4.0.0, < 4.18.8; >= 5.0.0, < 5.11.0", "ecosystem": "composer"}]
ecosystems: []
tags: ["composer", "craft-cms", "package", "php", "rce", "self-hosted"]
not_affected_if: ["control-panel-users-trusted", "enabletwigsandbox-false", "no-control-panel-access", "not-on-affected-versions"]
published_at: "2026-10-19T20:17:54+00:00"
first_seen_at: "2026-10-23T21:57:19+00:00"
updated_at: "2026-10-24T00:20:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112770", "first_seen_at": "2026-10-23T21:57:19+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:20:19+00:00"}]
---

# Craft CMS: Twig filter lets control panel users run code on server

Craft CMS 4.0.0 to before 4.18.8 and 5.0.0 to before 5.11.0: the Twig group filter calls a non-string arrow argument as a PHP callable without the checkArrow guard other filters use. A control panel user can pass an array callable such as ['craft\helpers\FileHelper','writeToFile'] through element-select condition rules and write a webshell to the webroot. The code then runs as the web user. The vendor says exploitation needs enableTwigSandbox=true (default false) and a control panel account, including lower-privilege editors.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- composer:craftcms/cms affected >= 4.0.0, < 4.18.8; >= 5.0.0, < 5.11.0 fixed 4.18.8, 5.11.0

## How to check

Run 'composer show craftcms/cms' or './craft --version' and compare with 4.18.8 / 5.11.0. Then check config/general.php for 'enableTwigSandbox' => true. The vendor says the bug is only reachable when it is true; the default is false. Look in the webroot for unexpected .php files and in access logs for odd control panel requests.

## Fix

Upgrade craftcms/cms to 4.18.8 (4.x) or 5.11.0 (5.x) or later: 'composer update craftcms/cms'. The vendor lists no workaround. Until you upgrade, limit control panel accounts to trusted users and make the webroot non-writable by the web user.

## Timeline

- 2026-10-23T21:57:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112770
- 2026-10-24T00:20:19+00:00 analyst — Read vendor GHSA-xmwr-88vw-5ghh and CVE record. Key finding: the advisory says reachable only with enableTwigSandbox=true (default false) plus control panel login. GHSA lists '<= 4.18.8' but patched 4.18.8; CVE says before 4.18.8, so I used that. No public PoC or exploitation found. No X posts. No vendor workaround; the interim steps below are my inference.

## Documents

- [advisory] GHSA-xmwr-88vw-5ghh: Authenticated RCE via Twig group filter array-callable https://github.com/craftcms/cms/security/advisories/GHSA-xmwr-88vw-5ghh
- [describes] CVE Record CVE-2026-112770 https://www.cve.org/CVERecord?id=CVE-2026-112770

## From the sources

Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in the Twig group filter, which invokes non-string arrow arguments as callables without the checkArrow guard used by other arrow-accepting filters. Authenticated control panel users can pass an array-callable such as FileHelper::writeToFile via element-select condition rules to write a webshell to the webroot and execute code as the web user.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_