CVE-2026-109304: Craft CMS Information Disclosure Vulnerability

CVE-2026-109304 Overview

CVE-2026-109304 is an arbitrary file read vulnerability in Craft CMS affecting versions 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14. The flaw exists because the Twig create() class blocklist does not cover DOMDocument. Attackers who can set an entry-type title format, including via project-config/apply, can invoke create('DOMDocument').loadHTMLFile() and use textContent to expose local file contents. The exposed data becomes visible to non-admin users who can view entries. The weakness is categorized as [CWE-200] Information Exposure.

Critical Impact
Authenticated attackers with high privileges can read arbitrary local files through the Twig templating engine, exposing configuration files, credentials, and other sensitive data to lower-privileged entry viewers.

Affected Products

Craft CMS 4.0.0 through 4.18.6
Craft CMS 5.0.0 through 5.10.13
Deployments permitting project-config/apply or entry-type title format modifications

Discovery Timeline

2026-10-12 - CVE-2026-109304 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-109304

Vulnerability Analysis

Craft CMS uses the Twig templating engine to render dynamic content, including entry-type title formats. Twig's create() function in Craft is restricted by a class blocklist intended to prevent instantiation of dangerous PHP classes. The blocklist did not include PHP's built-in DOMDocument class.

An attacker who can modify an entry-type title format can construct a Twig expression that calls create('DOMDocument').loadHTMLFile(path) against any file readable by the web server process. The resulting document's textContent property returns the parsed file contents as a string. When an entry is rendered, that string becomes the entry title, which is then displayed to any non-admin user authorized to view the entry.

The vulnerability requires elevated privileges to set the title format, either directly through the control panel or indirectly via project-config/apply, which processes YAML project configuration files. Exposed data can include .env files, database credentials, application secrets, and other local filesystem content.

Root Cause

The root cause is an incomplete deny list in the Twig create() sandbox. The blocklist enumerates dangerous classes but omits DOMDocument, whose file-loading methods expose filesystem contents through object properties. Deny-list sandboxing fails when new primitives are introduced without updating the list.

Attack Vector

Exploitation requires network access and an authenticated account with permission to modify entry-type title formats or push project configuration via project-config/apply. The attacker sets a title format containing a Twig expression that instantiates DOMDocument, loads a target file, and emits textContent. Rendered entry titles then disclose file contents to any viewer with entry access.

See the GitHub Security Advisory and the VulnCheck Advisory on Craft CMS for additional technical context.

Detection Methods for CVE-2026-109304

Indicators of Compromise

Entry-type title formats containing Twig expressions referencing create('DOMDocument'), loadHTMLFile, loadXML, or textContent
Unexpected changes to project.yaml or related project-config files, especially within entryTypes sections
Entry titles rendering filesystem content such as fragments of .env, /etc/passwd, or configuration keys
Web server access logs showing control panel requests to entry-type or project-config endpoints from non-administrative accounts

Detection Strategies

Audit all entry-type title format strings across every section for Twig calls to create() with any class argument
Review version control history for config/project/ directory changes referencing DOMDocument or loadHTMLFile
Enable Craft CMS audit logging and alert on modifications to entry-type configuration by non-administrator accounts

Monitoring Recommendations

Monitor project-config/apply command execution and HTTP endpoint usage, correlating with the invoking user identity
Track entry rendering responses that return abnormally long titles or titles containing path-like strings
Forward Craft CMS application logs and web server logs to a central analytics platform for correlation and historical review

How to Mitigate CVE-2026-109304

Immediate Actions Required

Upgrade Craft CMS to version 4.18.7 or 5.10.14 as soon as possible
Review all existing entry-type title formats and remove any Twig expressions invoking create() with class arguments
Restrict administrative and project-config permissions to a minimum set of trusted users
Rotate any credentials, API keys, or secrets stored in files that the web server process can read

Patch Information

Craft CMS resolved CVE-2026-109304 in versions 4.18.7 and 5.10.14 by extending the Twig create() class blocklist to cover DOMDocument. Refer to the GitHub Security Advisory GHSA-j5wg-m2pr-35qc for the official fix and release notes.

Workarounds

Revoke permission to edit entry-type settings from non-administrator accounts until patching is complete
Disable or restrict access to project-config/apply from untrusted sources, including CI pipelines without strict review
Deploy filesystem permissions that limit the web server process from reading sensitive files such as .env outside the application scope

bash

# Upgrade Craft CMS to a patched release via Composer
composer require craftcms/cms:^5.10.14 -w
# or for the 4.x branch
composer require craftcms/cms:^4.18.7 -w
php craft migrate/all
php craft project-config/apply