Live › vulnerability › CVE-2026-112772
Go to dashboardCraft CMS versions from 5.0.0 before 5.11.0 let a logged-in Control Panel user escape the Twig sandbox through asset transforms. The attacker can attach malicious behaviors or event handlers that execute code as the web server user.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Run composer show craftcms/cms and check whether the version is 5.0.0 up to but not including 5.11.0.
Upgrade craftcms/cms to 5.11.0 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox via Asset::getMimeType transforms. Attackers can supply 'as' or 'on' keys passed unfiltered to Craft::createObject, attaching malicious behaviors or event handlers that execute code as the web user.
This page as .md · .json · in your agent: get_signal("CVE-2026-112772")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.