CVE-2026-112777 Craft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist Bypass Leading to RCE
Craft CMS administrators can bypass Twig blocklists to execute remote code or read secrets via case-sensitive class name checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-112777?
CVE-2026-112777 is a high-severity code injection vulnerability in craftcms cms, published on 19 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its class-name checks are case-sensitive while PHP class resolution is not. Attackers with template-execution rights, such as Control Panel administrators, can instantiate SplFileObject via a lowercase class name to read .env secrets or write a PHP file into the webroot for remote code execution.
Weakness: CWE-184
Which versions are affected by CVE-2026-112777?
How do I fix CVE-2026-112777?
No fix has been published for CVE-2026-112777 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-112777 being exploited?
There is no known exploitation of CVE-2026-112777 in the wild and no public exploit code.
Sources
Also known as GHSA-f7pv-pv9r-vg93, GHSA-w643-x88w-6wcm.