CVE-2026-112776

Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contain a blocklist bypass in the Twig create() function because its class-name checks are case-sensitive while PHP class resolution is not. Attackers with template-execution rights, such as Control Panel administrators, can instantiate SplFileObject via a lowercase class name to read .env secrets or write a PHP file into the webroot for remote code execution.

Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate them for active users. Attackers who obtain a victim's emailed code can submit it to users/set-password after the victim verifies an email change, resetting the password and taking over the account.

Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability. An authenticated administrator can inject Yii behaviors by supplying a JSON-string field layout to ContentBlock::setFieldLayout(), with 'as X' or 'on X' keys bypassing cleanseConfig().

Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability. An authenticated Control Panel user can escape the Twig sandbox by passing uncleansed criteria to getNext, getPrev, or getOwners and injecting Yii 'as' or 'on' config keys.

Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability. An authenticated Control Panel user can escape the Twig sandbox via Asset::getMimeType transforms by supplying 'as' or 'on' keys passed unfiltered to Craft::createObject.

Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in the Twig group filter. The filter invokes non-string arrow arguments as callables without the checkArrow guard, allowing authenticated users to pass an array-callable such as FileHelper::writeToFile.

Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure vulnerability in AssetsController::actionMoveInfo that fails to enforce volume permissions. Authenticated control panel users can submit POST requests to the assets/move-info endpoint with arbitrary folderIds to retrieve asset count and total storage size for volumes they cannot access.

Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers permission to mint password reset URLs for administrator accounts. Attackers can generate a valid reset URL and set a new password, enabling complete control-panel takeover.

Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 contain a missing authorization vulnerability in AssetsController::actionReplaceFile. When a request supplies sourceAssetId and targetFilename but omits assetId, the replacePeerFiles permission is never enforced, allowing an authenticated low-privilege author with replaceFiles permission to overwrite peer asset files.

Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite(). The method checks permissions only against the user's own provisional draft, then deletes the canonical element without re-checking, allowing an authenticated user without deleteEntriesForSite permission to hard-delete entries.