Vulnerabilities

Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig…

Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox via Asset::getMimeType transforms. Attackers can supply 'as' or 'on' keys passed unfiltered to Craft::createObject, attaching malicious behaviors or event handlers that execute code as the web user.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

Craft CMS, PHP

Product

Craft CMS, PHP

CVSS

8.8

Exposure class

Web platform

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-112772 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 15
   CVE NVD 12d ago

   Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its class-name checks are…

   CVSS 7.2 CVE-2026-112777 Craft CMS PHP
2. 15
   CVE NVD 12d ago

   Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to inject Yii behaviors by…

   CVSS 7.2 CVE-2026-112774 Craft CMS PHP
3. 15
   CVE NVD 12d ago

   Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig…

   CVSS 8.8 CVE-2026-112773 Craft CMS PHP
4. 8
   CVE NVD 12d ago

   Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contains a Twig sandbox allowlist bypass because the column, contains, filterByValue, index…

   CVSS 6.5 CVE-2026-112771 Craft CMS PHP
5. 15
   CVE NVD 12d ago

   Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in the Twig group filter, which invokes non-string…

   CVSS 8.8 CVE-2026-112770 Craft CMS PHP