CVE-2026-72779
Full vulnerability record from the local CVENow database.
Description
Craft CMS 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2 contain an arbitrary file read vulnerability. The create() Twig function restricts class instantiation using a 5-entry blocklist that does not include SplFileObject, allowing an authenticated administrator (with allowAdminChanges=true) to configure a malicious entry type title or URI format that instantiates SplFileObject in a non-sandboxed template context. When a user subsequently creates an entry in the affected section, arbitrary files on the server (such as .env containing the security key and database credentials) are read and rendered as entry titles.
Severity
HIGH
CVSS score
8.7
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2026-08-11 13:19:08.360000
Last modified
2026-10-24 15:10:00.190000
View original CVE JSON
{
"id": "CVE-2026-72779",
"sourceIdentifier": "[email protected]",
"published": "2026-08-11T13:19:08.360",
"lastModified": "2026-10-24T15:10:00.190",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Craft CMS 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2 contain an arbitrary file read vulnerability. The create() Twig function restricts class instantiation using a 5-entry blocklist that does not include SplFileObject, allowing an authenticated administrator (with allowAdminChanges=true) to configure a malicious entry type title or URI format that instantiates SplFileObject in a non-sandboxed template context. When a user subsequently creates an entry in the affected section, arbitrary files on the server (such as .env containing the security key and database credentials) are read and rendered as entry titles."
},
{
"lang": "es",
"value": "Craft CMS 5.0.0-RC1 anterior a 5.10.6 y 4.0.0-RC1 anterior a 4.18.2 contienen una vulnerabilidad de lectura arbitraria de archivos. La función Twig create() restringe la instanciación de clases utilizando una lista de bloqueo de 5 entradas que no incluye SplFileObject, lo que permite a un administrador autenticado (con allowAdminChanges=true) configurar un título de tipo de entrada o formato URI malicioso que instancia SplFileObject en un contexto de plantilla no aislado. Cuando un usuario crea posteriormente una entrada en la sección afectada, los archivos arbitrarios en el servidor (como .env que contiene la clave de seguridad y las credenciales de la base de datos) se leen y se renderizan como títulos de entrada."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "craftcms",
"product": "cms",
"defaultStatus": "unaffected",
"packageURL": "pkg:composer/craftcms/cms",
"versions": [
{
"version": "5.0.0-RC1",
"lessThan": "5.10.6",
"versionType": "semver",
"status": "affected"
},
{
"version": "5.10.6",
"versionType": "semver",
"status": "unaffected"
}
]
},
{
"vendor": "craftcms",
"product": "cms",
"defaultStatus": "unaffected",
"packageURL": "pkg:composer/craftcms/cms",
"versions": [
{
"version": "4.0.0-RC1",
"lessThan": "4.18.2",
"versionType": "semver",
"status": "affected"
},
{
"version": "4.18.2",
"versionType": "semver",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N",
"baseScore": 4.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 0.9,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-11T14:54:30.379349Z",
"id": "CVE-2026-72779",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-184"
}
]
}
],
"references": [
{
"url": "https://github.com/craftcms/cms/security/advisories/GHSA-957r-qf9p-67xw",
"source": "[email protected]"
},
{
"url": "https://www.vulncheck.com/advisories/craft-cms-rc1-before-arbitrary-file-read-via-splfileobject",
"source": "[email protected]"
}
]
}