CVE-2026-72779: Craft CMS 5.0.0-RC1 before 5.10.6 Arbitrary File Read via SplFileObject
Craft CMS 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2 contain an arbitrary file read vulnerability. The create() Twig function restricts class instantiation using a 5-entry blocklist that does not include SplFileObject, allowing an authenticated administrator (with allowAdminChanges=true) to configure a malicious entry type title or URI format that instantiates SplFileObject in a non-sandboxed template context. When a user subsequently creates an entry in the affected section, arbitrary files on the server (such as .env containing the security key and database credentials) are read and rendered as entry titles.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Craft CMSto a version that resolves this vulnerability.Fixed in 5.10.6 - Upgrade
Upgrade
Craft CMSto a version that resolves this vulnerability.Fixed in 4.18.2 - Configuration
If possible, disable allowAdminChanges so authenticated administrators cannot configure a malicious entry type title or URI format that would instantiate SplFileObject in a non-sandboxed template context.
Craft CMS allowAdminChanges = false - Compensating control
Harden the application environment so sensitive files (for example, the .env security key and database credentials) are not readable by the web process (e.g., filesystem permissions) to limit impact of any arbitrary file read.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72779?
CVE-2026-72779 has a severity rating of medium, with a score of 4.5.
How do I fix CVE-2026-72779?
To fix CVE-2026-72779, upgrade Craft CMS to version 5.10.6 or 4.18.2 or later.
What systems are affected by CVE-2026-72779?
CVE-2026-72779 affects Craft CMS versions 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2.
What type of vulnerability is CVE-2026-72779?
CVE-2026-72779 is classified as an arbitrary file read vulnerability.
Who can exploit CVE-2026-72779?
An authenticated administrator with the allowAdminChanges=true setting can exploit CVE-2026-72779.