---
id: "CVE-2026-112777"
kind: "vulnerability"
aliases: ["CVE-2026-112777"]
title: "Craft CMS: Twig create() blocklist bypass lets admins write PHP files"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["craft-cms", "php", "runtime", "self-hosted"]
not_affected_if: ["already-upgraded", "no-control-panel-admins-untrusted"]
published_at: "2026-10-19T20:17:55+00:00"
first_seen_at: "2026-10-23T21:57:19+00:00"
updated_at: "2026-10-23T22:37:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112777", "first_seen_at": "2026-10-23T21:57:19+00:00"}]
---

# Craft CMS: Twig create() blocklist bypass lets admins write PHP files

Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 check Twig class names case-sensitively, but PHP resolves them case-insensitively, so a lowercase class name slips past the blocklist. An attacker with template-execution rights, such as a Control Panel administrator, can read .env secrets or write a PHP file into the webroot for remote code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check the installed Craft version with composer show craftcms/cms or by reading vendor/craftcms/cms/src/Application.php for the version constant.
If the version is 4.x below 4.18.8 or 5.x below 5.11.0, the install is affected.

## Fix

Upgrade Craft CMS to 4.18.8 or later on the 4.x line, or 5.11.0 or later on the 5.x line.
Restrict Control Panel admin accounts to trusted staff until the upgrade is applied.

## Timeline

- 2026-10-23T21:57:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112777

## From the sources

Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its class-name checks are case-sensitive while PHP class resolution is not. Attackers with template-execution rights, such as Control Panel administrators, can instantiate SplFileObject via a lowercase class name to read .env secrets or write a PHP file into the webroot for remote code execution.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_