Key points
- Craft CMS versions before 4.18.8 and 5.11.0 contain a blocklist bypass in the Twig create function.
- The vulnerability, rated CVSS 8.7 HIGH, stems from case-sensitive class checks conflicting with PHP resolution.
- Attackers with template-execution rights can read .env files or write PHP files to the webroot.
Craft CMS administrators must address a high-severity vulnerability that allows attackers to bypass security blocklists within the Twig template engine. This flaw affects versions 4.x prior to 4.18.8 and 5.x prior to 5.11.0, exposing environments where users possess template-execution privileges, such as Control Panel administrators. The issue arises because the application’s class-name checks are case-sensitive, whereas PHP class resolution is not.
According to the National Vulnerability Database, this discrepancy enables attackers to instantiate the SplFileObject class by using a lowercase name that evades the blocklist. This capability allows malicious actors to read sensitive configuration files, such as .env secrets, or write arbitrary PHP files into the webroot. Such actions can lead to remote code execution, effectively compromising the entire server hosting the content management system.
Technical Context and Impact
The vulnerability is classified under CWE-184, which relates to incorrect subcomponent comparison. The NVD record describes the flaw as a blocklist bypass in the Twig create() function. Because the security filter fails to normalize case before checking against the blocklist, it misses threats that use different capitalization. This allows the creation of objects that should be restricted.
Affected Environments
Craft CMS installations running version 4.x before 4.18.8 are exposed to this risk. Similarly, systems on the 5.x branch before 5.11.0 contain the same defect. Any environment where users have template-execution rights, including administrative roles within the Control Panel, is potentially vulnerable. Attackers do not need full system access; template privileges are sufficient to exploit this weakness and escalate their control over the application.
Next steps
Security teams should inventory all Craft CMS instances to identify versions prior to 4.18.8 and 5.11.0. Administrators must plan to upgrade to the patched versions once available to close this gap. Until updates are applied, monitor for unusual file creation in the webroot and unexpected access to configuration files. Restricting template-execution rights to only necessary personnel can reduce the immediate attack surface.
Signals worth monitoring
Teams usually detect this activity by reviewing web server logs for unusual requests targeting sensitive configuration files or unexpected writes to the webroot. Check whether any user accounts with template privileges have accessed files outside the standard content directories. Monitor for the creation of new PHP files in public directories, which often indicates an attempt to establish a backdoor. Review access logs for patterns where sensitive data like .env files is queried repeatedly. Look for anomalies in file modification times that do not correspond with scheduled deployments or legitimate administrative actions.
What to do and how to stay safe: Craft CMS
- Audit user roles to ensure only essential personnel have template-execution rights in Craft CMS.
- Monitor web server access logs for requests attempting to read configuration files like .env.
- Watch for the creation of new PHP files in the webroot by non-administrative accounts.
- Verify that all installations are updated to versions 4.18.8 or 5.11.0 once patches are released.
Step-by-step guide: Emergency Patching Checklist for Critical System Fixes
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Craft CMS versions are vulnerable to CVE-2026-112777?
Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 are affected by this vulnerability.
What is the severity rating of this flaw?
The National Vulnerability Database rates CVE-2026-112777 as HIGH with a CVSS score of 8.7.
How can attackers exploit this vulnerability?
Attackers can use lowercase class names to bypass blocklists and instantiate SplFileObject for reading secrets or writing PHP files.
