CVE-2026-112777: Craft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist Bypass Leading to RCE
Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its class-name checks are case-sensitive while PHP class resolution is not. Attackers with template-execution rights, such as Control Panel administrators, can instantiate SplFileObject via a lowercase class name to read .env secrets or write a PHP file into the webroot for remote code execution.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue in practice?
An attacker needs template-execution rights. The advisory identifies Control Panel administrators as an example of a user role with the required level of access.
What can an attacker do after exploiting the bypass?
They can instantiate SplFileObject using a lowercase class name. This can be used to read .env secrets or write a PHP file into the webroot, resulting in remote code execution.
Which Craft CMS releases need to be updated?
Craft CMS 4.x releases before 4.18.8 and 5.x releases before 5.11.0 are affected. Update to 4.18.8 or a later 4.x release, or to 5.11.0 or a later 5.x release.