CVE-2026-112772: Craft CMS 5.0.0 before 5.11.0 RCE via Asset::getMimeType Transform Injection
Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox via Asset::getMimeType transforms. Attackers can supply 'as' or 'on' keys passed unfiltered to Craft::createObject, attaching malicious behaviors or event handlers that execute code as the web user.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs an authenticated Craft CMS Control Panel account. The issue enables that user to execute code as the web user.
Which deployments are affected?
Craft CMS versions from 5.0.0 up to, but not including, 5.11.0 are affected. The provided information does not identify a configuration prerequisite beyond access to the Control Panel.
What access or interaction is required for exploitation?
Exploitation requires low-privileged authenticated access and does not require user interaction. The attacker supplies unfiltered "as" or "on" keys through Asset::getMimeType transforms to attach malicious behaviors or event handlers.
What should be prioritized for remediation?
Upgrade affected Craft CMS installations to 5.11.0 or later. Because successful exploitation provides code execution as the web user, review Control Panel accounts and limit Control Panel access while remediation is underway.