{"id":"CVE-2026-112772","kind":"vulnerability","aliases":["CVE-2026-112772"],"related":[],"title":"Craft CMS: authenticated control panel users can run code on the server","description":"Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox via Asset::getMimeType transforms. Attackers can supply 'as' or 'on' keys passed unfiltered to Craft::createObject, attaching malicious behaviors or event handlers that execute code as the web user.","summary":"Craft CMS versions from 5.0.0 before 5.11.0 let a logged-in Control Panel user escape the Twig sandbox through asset transforms. The attacker can attach malicious behaviors or event handlers that execute code as the web server user.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["craft-cms","package","php","self-hosted"],"not_affected_if":["already-on-5.11.0-or-later","no-control-panel-users"],"how_to_check":"Run composer show craftcms/cms and check whether the version is 5.0.0 up to but not including 5.11.0.","fix":"Upgrade craftcms/cms to 5.11.0 or later.","status":"open","published_at":"2026-10-19T20:17:54+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-23T22:33:04+00:00","updated_at":"2026-10-23T22:33:04+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T22:33:04Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade craftcms/cms to 5.11.0 or later.","reach":"internet","title":"Craft CMS: authenticated control panel users can run code on the server","impact":"high","summary":"Craft CMS versions from 5.0.0 before 5.11.0 let a logged-in Control Panel user escape the Twig sandbox through asset transforms. The attacker can attach malicious behaviors or event handlers that execute code as the web server user.","category":"package","who_cares":["craft-cms","php","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Code runs as the web user on the server","analyst_note":"","how_to_check":"Run composer show craftcms/cms and check whether the version is 5.0.0 up to but not including 5.11.0.","needs_analyst":false,"not_affected_if":["already-on-5.11.0-or-later","no-control-panel-users"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000471,"input_tokens":2949,"output_tokens":352,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112772':15A,18A '-2026':14A,17A '5.0.0':31B,69C '5.11.0':33B,71C 'allow':79C 'asset':47B,90C 'attach':52B,105C 'attack':50B,93C 'authent':3A,80C 'behavior':54B,107C 'cms':2A,21B,28B,67C 'code':9A,60B,75C,113C 'contain':72C 'control':4A,39B,81C 'craft':1A,20B,27B,66C,103C 'craft-cm':19B 'createobject':104C 'cve':13A,16A 'escap':42B,85C 'event':56B,109C 'execut':59B,76C,112C 'getmimetyp':91C 'handler':57B,110C 'host':26B 'key':99C 'let':34B 'log':37B 'logged-in':36B 'malici':53B,106C 'packag':22B 'panel':5A,40B,82C 'pass':100C 'php':23B 'remot':74C 'run':8A 'sandbox':45B,88C 'self':25B 'self-host':24B 'server':12A,64B 'suppli':95C 'transform':48B,92C 'twig':44B,87C 'unfilt':101C 'user':6A,41B,65B,83C,117C 'version':29B 'via':89C 'vulner':77C 'web':63B,116C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T20:17:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112772","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112772","severity":null,"published_at":"2026-10-19T20:17:54+00:00","modified_at":"2026-10-20T17:17:31+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}