{"id":"CVE-2026-112777","kind":"vulnerability","aliases":["CVE-2026-112777"],"related":[],"title":"Craft CMS: Twig create() blocklist bypass lets admins write PHP files","description":"Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its class-name checks are case-sensitive while PHP class resolution is not. Attackers with template-execution rights, such as Control Panel administrators, can instantiate SplFileObject via a lowercase class name to read .env secrets or write a PHP file into the webroot for remote code execution.","summary":"Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 check Twig class names case-sensitively, but PHP resolves them case-insensitively, so a lowercase class name slips past the blocklist. An attacker with template-execution rights, such as a Control Panel administrator, can read .env secrets or write a PHP file into the webroot for remote code execution.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["craft-cms","php","runtime","self-hosted"],"not_affected_if":["already-upgraded","no-control-panel-admins-untrusted"],"how_to_check":"Check the installed Craft version with composer show craftcms/cms or by reading vendor/craftcms/cms/src/Application.php for the version constant.\nIf the version is 4.x below 4.18.8 or 5.x below 5.11.0, the install is affected.","fix":"Upgrade Craft CMS to 4.18.8 or later on the 4.x line, or 5.11.0 or later on the 5.x line.\nRestrict Control Panel admin accounts to trusted staff until the upgrade is applied.","status":"open","published_at":"2026-10-19T20:17:55+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-23T22:37:28+00:00","updated_at":"2026-10-23T22:37:28+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-23T22:37:28Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Craft CMS to 4.18.8 or later on the 4.x line, or 5.11.0 or later on the 5.x line.\nRestrict Control Panel admin accounts to trusted staff until the upgrade is applied.","reach":"internet","title":"Craft CMS: Twig create() blocklist bypass lets admins write PHP files","impact":"high","summary":"Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 check Twig class names case-sensitively, but PHP resolves them case-insensitively, so a lowercase class name slips past the blocklist. An attacker with template-execution rights, such as a Control Panel administrator, can read .env secrets or write a PHP file into the webroot for remote code execution.","category":"runtime","who_cares":["craft-cms","php","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker reads .env secrets or runs PHP code on the server.","analyst_note":"Confirm the fixed versions and whether the Twig create() bypass has a public proof of concept at https://nvd.nist.gov/vuln/detail/CVE-2026-112777 and the Craft CMS release notes.","how_to_check":"Check the installed Craft version with composer show craftcms/cms or by reading vendor/craftcms/cms/src/Application.php for the version constant.\nIf the version is 4.x below 4.18.8 or 5.x below 5.11.0, the install is affected.\nunknown","needs_analyst":true,"not_affected_if":["already-upgraded","no-control-panel-admins-untrusted"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000594,"input_tokens":2966,"output_tokens":594,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112777':14A,17A '-2026':13A,16A '4':28B,91C '4.18.8':31B,94C '5':33B,96C '5.11.0':36B,99C 'admin':8A 'administr':72B,135C 'attack':61B,125C 'blocklist':5A,59B,102C 'bypass':6A,103C 'case':42B,49B,117C 'case-insensit':48B 'case-sensit':41B,116C 'check':37B,114C 'class':39B,54B,112C,121C,142C 'class-nam':111C 'cms':2A,20B,27B,90C 'code':87B,158C 'contain':100C 'control':70B,133C 'craft':1A,19B,26B,89C 'craft-cm':18B 'creat':4A,107C 'cve':12A,15A 'env':75B,146C 'execut':65B,88B,129C,159C 'file':11A,81B,152C 'function':108C 'host':25B 'insensit':50B 'instanti':137C 'let':7A 'lowercas':53B,141C 'name':40B,55B,113C,143C 'panel':71B,134C 'past':57B 'php':10A,21B,45B,80B,120C,151C 'read':74B,145C 'remot':86B,157C 'resolut':122C 'resolv':46B 'right':66B,130C 'runtim':22B 'secret':76B,147C 'self':24B 'self-host':23B 'sensit':43B,118C 'slip':56B 'splfileobject':138C 'templat':64B,128C 'template-execut':63B,127C 'twig':3A,38B,106C 'via':139C 'webroot':84B,155C 'write':9A,78B,149C 'x':29B,34B,92C,97C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T20:17:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112777","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112777","severity":null,"published_at":"2026-10-19T20:17:55+00:00","modified_at":"2026-10-20T17:17:31+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}