Live › vulnerability › CVE-2026-112777
Go to dashboardCraft CMS 4.x before 4.18.8 and 5.x before 5.11.0 check Twig class names case-sensitively, but PHP resolves them case-insensitively, so a lowercase class name slips past the blocklist. An attacker with template-execution rights, such as a Control Panel administrator, can read .env secrets or write a PHP file into the webroot for remote code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
composer show craftcms/cms or by reading vendor/craftcms/cms/src/Application.php for the version constant4.18.8 or 5.x below 5.11.0, the install is affected4.18.8 or later on the 4.x line, or 5.11.0 or later on the 5.x lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its class-name checks are case-sensitive while PHP class resolution is not. Attackers with template-execution rights, such as Control Panel administrators, can instantiate SplFileObject via a lowercase class name to read .env secrets or write a PHP file into the webroot for remote code execution.
This page as .md · .json · in your agent: get_signal("CVE-2026-112777")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.