Craft CMS: Twig create() blocklist bypass allows file read and remote code execution
Summary
Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contain a blocklist bypass in the Twig create() function. Its class-name checks are case-sensitive, but PHP class resolution is not, so a lowercase class name such as splfileobject instantiates SplFileObject. An attacker with template-execution rights, such as a Control Panel administrator, can read files such as .env (including the security key and database credentials) and write a PHP file into the webroot, which leads to remote code execution. The NVD record scores this 8.7 (CVSS 4.0), but the vector lists no privileges required, which contradicts the description. The GitHub advisory rates it Low, so the official score may change.
Affected
- Craft CMS 4.0.0 to before 4.18.8
- Craft CMS 5.0.0 to before 5.11.0
Fixed in
- Craft CMS 4.18.8
- Craft CMS 5.11.0
Workaround
- No vendor-documented workaround. Apply the update.
- Interim risk reduction: review accounts with Control Panel or template-execution rights and remove unneeded ones.
Exploitation
- No evidence of exploitation in the wild was found at the time of research.
- Not listed in CISA KEV; no public proof of concept was found. Re-check before relying on this.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
Our recommendation
- Identify public-facing Craft CMS sites and update to 4.18.8, 5.11.0 or later.
- Limit Control Panel administrator and template-execution rights to the people who need them.
- Check that .env files are not web-accessible and review the webroot for unexpected PHP files.
- Monitor logs for unusual requests to newly created files and for changes to the Control Panel user list.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-w643-x88w-6wcm github.com
- VulnCheck advisory: Craft CMS Twig create() blocklist bypass www.vulncheck.com
- Craft CMS 4.18.8 release notes newreleases.io
- Craft CMS 5.11.0 release notes newreleases.io
- Vulners OSV entry for CVE-2026-112777 vulners.com
- ACN alert: Craft CMS vulnerabilities www.acn.gov.it
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 01:56.
Original description (NVD)
Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its class-name checks are case-sensitive while PHP class resolution is not. Attackers with template-execution rights, such as Control Panel administrators, can instantiate SplFileObject via a lowercase class name to read .env secrets or write a PHP file into the webroot for remote code execution.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.