CVE-2026-72779 json
Craft CMS 5.0.0-RC1 before 5.10.6 Arbitrary File Read via SplFileObject
published 2026-08-06 3 mo ago modified 2026-10-24 15 d ago also GHSA-957r-qf9p-67xw , EUVD-2026-56103
- cvss
- 4.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 31%
- public exploits
- 0
- none known
Summary
Craft CMS 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2 contain an arbitrary file read vulnerability. The create() Twig function restricts class instantiation using a 5-entry blocklist that does not include SplFileObject, allowing an authenticated administrator (with allowAdminChanges=true) to configure a malicious entry type title or URI format that instantiates SplFileObject in a non-sandboxed template context. When a user subsequently creates an entry in the affected section, arbitrary files on the server (such as .env containing the security key and database credentials) are read and rendered as entry titles.
Patch / fix
- packagist craftcms/cms 4.18.2, 5.10.6
- craftcms cms 4.18.2, 5.10.6
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 mo ago
Exploit prediction
0.38% chance of exploitation in the next 30 days, higher than 31% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 4.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N |
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | craftcms/cms | >=5.0.0-RC1, <5.10.6 >=4.0.0-RC1, <4.18.2 |
5.10.6 4.18.2 |
Affected products
- craftcms cms
Classification
- Weakness
-
- CWE-184 Incomplete List of Disallowed Inputs
References
-
github.com
/craftcms/cms/commit/7c96fd73df936a10e8f85ae6ef61a9fc3f277c12
web
-
github.com
/craftcms/cms/commit/87978f11c8f986c40ef41b941d79547230c4d6d9
web
-
github.com
/craftcms/cms/security/advisories/GHSA-957r-qf9p-67xw
vendor-advisory, web
-
vulncheck.com
/advisories/craft-cms-rc1-before-arbitrary-file-read-via-splfileobject
third-party-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-72779
advisory
-
github.com
/craftcms/cms
package
-
github.com
/craftcms/cms/releases/tag/4.18.2
web
-
github.com
/craftcms/cms/releases/tag/5.10.6
web
Sources
- CVE List CVE-2026-72779
- GitHub Advisory GHSA-957r-qf9p-67xw
- NVD CVE-2026-72779
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.