CVE-2026-72779: Craft CMS 5.0.0-RC1 before 5.10.6 Arbitrary File Read via SplFileObject
Craft CMS 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2 contain an arbitrary file read vulnerability. The create() Twig function restricts class instantiation using a 5-entry blocklist that does not include SplFileObject, allowing an authenticated administrator (with allowAdminChanges=true) to configure a malicious entry type title or URI format that instantiates SplFileObject in a non-sandboxed template context. When a user subsequently creates an entry in the affected section, arbitrary files on the server (such as .env containing the security key and database credentials) are read and rendered as entry titles.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Craft CMSto a version that resolves this vulnerability.Fixed in 5.10.6 - Upgrade
Upgrade
Craft CMSto a version that resolves this vulnerability.Fixed in 4.18.2 - Configuration
If possible, disable allowAdminChanges so authenticated administrators cannot configure a malicious entry type title or URI format that would instantiate SplFileObject in a non-sandboxed template context.
Craft CMS allowAdminChanges = false - Compensating control
Harden the application environment so sensitive files (for example, the .env security key and database credentials) are not readable by the web process (e.g., filesystem permissions) to limit impact of any arbitrary file read.