Twig Sandbox Allowlist Bypass in Craft CMS by Craft

CVE-2026-112771

What is CVE-2026-112771?

Craft CMS versions 4.0.0 to 4.18.7 and 5.0.0 to 5.10.9 are impacted by a Twig sandbox allowlist bypass vulnerability. This flaw arises from the filters 'column', 'contains', 'filterByValue', 'index', 'where', and 'multisort' resolving caller-supplied keys via ArrayHelper::getValue() without adhering to the designated sandbox security policy. Authenticated users with access to the Control Panel can exploit this vulnerability by supplying dot-path keys, which may lead to unauthorized traversal of sensitive information such as security keys, database credentials, and authentication tokens.

References