Skip to content

CVE record · 1 source

CVE-2026-112777

CVSS 7.2

Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its class-name checks are…

Vendor: Craft CMS, PHP
Product: Craft CMS, PHP
CVSS: 7.2
Exposure class: Web platform

Coverage

1

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

15

CVE NVD 12d ago

Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its class-name checks are…

Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its class-name checks are case-sensitive while PHP class resolution is not. Attackers with template-execution…

CVSS 7.2 CVE-2026-112777 Craft CMS PHP