{"id":"CVE-2026-112771","kind":"vulnerability","aliases":["CVE-2026-112771"],"related":[],"title":"Craft CMS: Twig sandbox bypass leaks security key and database credentials","description":"Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contains a Twig sandbox allowlist bypass because the column, contains, filterByValue, index, where, and multisort filters resolve caller-supplied keys via ArrayHelper::getValue() without consulting the sandbox security policy. Authenticated Control Panel users can supply dot-path keys to traverse the craft global and disclose the securityKey, database credentials, and auth tokens.","summary":"Craft CMS filters in the Twig template sandbox resolve caller-supplied dot-path keys without checking the sandbox policy, so they can reach the craft global. An authenticated Control Panel user can read the securityKey, database credentials and auth tokens.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["craft-cms","package","php","self-hosted"],"not_affected_if":["no-control-panel-users","patched-version"],"how_to_check":"- Check the installed Craft version in `composer.lock` or by running `php craft version`; affected versions are 4.0.0 to before 4.18.8 and 5.0.0 to before 5.11.0\n- Confirm which users have Control Panel access and whether untrusted users can edit Twig templates","fix":"- Upgrade Craft CMS 4.x to `4.18.8` or later\n- Upgrade Craft CMS 5.x to `5.11.0` or later\n- After upgrading, rotate the securityKey, database credentials and auth tokens if an untrusted user had Control Panel access","status":"open","published_at":"2026-10-19T20:17:54+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-25T03:34:51+00:00","updated_at":"2026-10-25T03:34:51+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:34:51Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Craft CMS 4.x to `4.18.8` or later\n- Upgrade Craft CMS 5.x to `5.11.0` or later\n- After upgrading, rotate the securityKey, database credentials and auth tokens if an untrusted user had Control Panel access","reach":"internet","title":"Craft CMS: Twig sandbox bypass leaks security key and database credentials","impact":"high","summary":"Craft CMS filters in the Twig template sandbox resolve caller-supplied dot-path keys without checking the sandbox policy, so they can reach the craft global. An authenticated Control Panel user can read the securityKey, database credentials and auth tokens.","category":"package","nicknames":[],"who_cares":["craft-cms","php","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Secrets and database credentials readable by a logged-in Control Panel user","analyst_note":"Check the Craft CMS 4.18.8 and 5.11.0 release notes and the NVD entry for any additional conditions or workarounds.","how_to_check":"- Check the installed Craft version in `composer.lock` or by running `php craft version`; affected versions are 4.0.0 to before 4.18.8 and 5.0.0 to before 5.11.0\n- Confirm which users have Control Panel access and whether untrusted users can edit Twig templates","needs_analyst":true,"not_affected_if":["patched-version","no-control-panel-users"],"who_is_affected":"Sites running Craft CMS 4.0.0 through 4.18.7 or 5.0.0 through 5.10.x are exposed, and the risk depends on Control Panel accounts. The flaw needs an authenticated Control Panel user who can run Twig filters, so sites where only trusted staff log in have a lower risk. Sites on patched releases or with no Control Panel users are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000684,"input_tokens":3402,"output_tokens":687,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112771':14A,17A '-2026':13A,16A '4.0.0':70C '4.18.8':72C '5.0.0':74C '5.11.0':76C 'allowlist':81C 'arrayhelp':99C 'auth':66B,129C 'authent':55B,107C 'bypass':5A,82C 'caller':36B,95C 'caller-suppli':35B,94C 'check':43B 'cms':2A,20B,27B,69C 'column':85C 'consult':102C 'contain':77C,86C 'control':56B,108C 'craft':1A,19B,26B,52B,68C,120C 'craft-cm':18B 'credenti':11A,64B,127C 'cve':12A,15A 'databas':10A,63B,126C 'disclos':123C 'dot':39B,114C 'dot-path':38B,113C 'filter':28B,92C 'filterbyvalu':87C 'getvalu':100C 'global':53B,121C 'host':25B 'index':88C 'key':8A,41B,97C,116C 'leak':6A 'multisort':91C 'packag':21B 'panel':57B,109C 'path':40B,115C 'php':22B 'polici':46B,106C 'reach':50B 'read':60B 'resolv':34B,93C 'sandbox':4A,33B,45B,80C,104C 'secur':7A,105C 'securitykey':62B,125C 'self':24B 'self-host':23B 'suppli':37B,96C,112C 'templat':32B 'token':67B,130C 'travers':118C 'twig':3A,31B,79C 'user':58B,110C 'via':98C 'without':42B,101C","nicknames":[],"mitigations":[],"who_affected":"Sites running Craft CMS 4.0.0 through 4.18.7 or 5.0.0 through 5.10.x are exposed, and the risk depends on Control Panel accounts. The flaw needs an authenticated Control Panel user who can run Twig filters, so sites where only trusted staff log in have a lower risk. Sites on patched releases or with no Control Panel users are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T20:17:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112771","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112771","severity":null,"published_at":"2026-10-19T20:17:54+00:00","modified_at":"2026-10-20T16:17:03+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}