Live › vulnerability › CVE-2026-112771
Go to dashboardCraft CMS filters in the Twig template sandbox resolve caller-supplied dot-path keys without checking the sandbox policy, so they can reach the craft global. An authenticated Control Panel user can read the securityKey, database credentials and auth tokens.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running Craft CMS 4.0.0 through 4.18.7 or 5.0.0 through 5.10.x are exposed, and the risk depends on Control Panel accounts. The flaw needs an authenticated Control Panel user who can run Twig filters, so sites where only trusted staff log in have a lower risk. Sites on patched releases or with no Control Panel users are not affected.
No product ranges from the sources yet.
composer.lock or by running php craft version; affected versions are 4.0.0 to before 4.18.8 and 5.0.0 to before 5.11.04.18.8 or later5.11.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contains a Twig sandbox allowlist bypass because the column, contains, filterByValue, index, where, and multisort filters resolve caller-supplied keys via ArrayHelper::getValue() without consulting the sandbox security policy. Authenticated Control Panel users can supply dot-path keys to traverse the craft global and disclose the securityKey, database credentials, and auth tokens.
This page as .md · .json · in your agent: get_signal("CVE-2026-112771")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.