CVE-2026-72779 Overview
Craft CMS contains an arbitrary file read vulnerability affecting versions 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2. The flaw resides in the create() Twig function, which enforces an incomplete 5-entry class instantiation blocklist. The blocklist omits SplFileObject, allowing an authenticated administrator with allowAdminChanges=true to instantiate the class in a non-sandboxed template context. Attackers can configure a malicious entry type title or URI format that reads arbitrary server files when a user creates an entry in the affected section. Sensitive files such as .env, containing the security key and database credentials, are read and rendered as entry titles.
Critical Impact
Authenticated administrators can exfiltrate sensitive server files, including credentials and application secrets, by abusing the incomplete blocklist in the Twig create() function.
Affected Products
- Craft CMS 5.0.0-RC1 through versions before 5.10.6
- Craft CMS 4.0.0-RC1 through versions before 4.18.2
- Installations with allowAdminChanges=true configured
Discovery Timeline
- 2026-08-11 - CVE-2026-72779 published to NVD
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-72779
Vulnerability Analysis
The vulnerability [CWE-184] stems from an incomplete deny-list approach in the Twig create() function. Craft CMS restricts class instantiation using a 5-entry blocklist intended to prevent dangerous class usage in templates. The blocklist fails to include SplFileObject, a native PHP class that reads and iterates file contents.
An authenticated administrator with allowAdminChanges=true can configure an entry type title or URI format that invokes create('SplFileObject', '/path/to/file'). Because the template context is non-sandboxed, the instantiation succeeds. When a user later creates an entry in the affected section, Craft renders the file contents as the entry title, exposing the data to the attacker.
Root Cause
The root cause is reliance on a deny-list rather than an allow-list for class instantiation. Deny-lists inherently fail when new dangerous classes exist outside the enumerated set. SplFileObject was not enumerated, allowing file read operations through template rendering.
Attack Vector
Exploitation requires authenticated administrator access with configuration change privileges. The attacker modifies an entry type title or URI format template to include a create() call targeting SplFileObject with a chosen file path. Entry creation in that section triggers the instantiation and file read. The rendered title contains file contents such as .env secrets, database credentials, or the Craft security key. Refer to the GitHub Security Advisory and the VulnCheck Advisory on Craft CMS for full technical details.
Detection Methods for CVE-2026-72779
Indicators of Compromise
- Entry type titles or URI formats containing create( calls referencing SplFileObject or other PHP native classes
- Recent modifications to section or entry type configurations by administrator accounts
- Entries with titles matching contents of server files such as .env, config/*.php, or /etc/passwd
- Unexpected administrator logins preceding entry type configuration changes
Detection Strategies
- Audit Craft CMS database tables holding section, entry type, and URI format definitions for suspicious create() usage
- Review Twig template inputs stored in the CMS for references to SplFileObject, SplFileInfo, or file system classes
- Correlate administrator configuration changes with subsequent entry creation events in access logs
Monitoring Recommendations
- Enable audit logging for all administrator changes to entry types, sections, and field layouts
- Monitor web server access logs for authenticated /admin requests modifying entry configurations
- Alert on entry titles containing patterns consistent with file contents, such as DB_PASSWORD= or SECURITY_KEY=
How to Mitigate CVE-2026-72779
Immediate Actions Required
- Upgrade Craft CMS to version 5.10.6 or 4.18.2 immediately
- Rotate the Craft security key, database credentials, and any secrets stored in .env if compromise is suspected
- Review all administrator accounts and revoke unnecessary allowAdminChanges=true privileges
- Audit existing entry types and URI formats for unauthorized create() calls
Patch Information
Craft CMS resolved the issue in versions 5.10.6 and 4.18.2 by extending the create() function blocklist to prevent instantiation of SplFileObject and related file access classes. Refer to the GitHub Security Advisory GHSA-957r-qf9p-67xw for release notes and remediation details.
Workarounds
- Set allowAdminChanges=false in production environments to prevent runtime configuration changes
- Restrict administrator account distribution and enforce multi-factor authentication on all admin logins
- Store secrets outside the web root and outside files readable by the PHP process where feasible
- Apply file system permissions that restrict the PHP process from reading sensitive configuration files
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
