Arbitrary File Read Vulnerability in Craft CMS by Craft CMS
CVE-2026-109304

6.9MEDIUM

Key Information:

Vendor

Craftcms

Status
Cms
Vendor
CVE Published:
12 October 2026

What is CVE-2026-109304?

Craft CMS versions 4.0.0 prior to 4.18.7 and 5.0.0 prior to 5.10.14 exhibit an arbitrary file read vulnerability due to inadequate blocklist coverage by the Twig create() class. This allows attackers, able to configure entry-type title formats, to exploit the create('DOMDocument').loadHTMLFile() function. By doing so, they can reveal sensitive local file contents to non-admin users who have access to view entries. Promptly applying the latest updates is essential to safeguard against this security threat.

Affected Version(s)

cms 4.0.0 < 4.18.7

cms 5.0.0 < 5.10.14

cms 4.18.7

References

https://github.com/craftcms/cms/security/advisories/GHSA-...
vendor-advisory
https://www.vulncheck.com/advisories/craft-cms-4.0.0-befo...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

baeseungwon1010
.