Remote Code Execution in Craft CMS Affects Multiple Versions by Craft CMS
CVE-2026-112772

8.7HIGH

Key Information:

Vendor

Craftcms

Status
Cms
Vendor
CVE Published:
19 October 2026

What is CVE-2026-112772?

Craft CMS versions 5.0.0 through 5.11.0 are exposed to a vulnerability that enables authenticated Control Panel users to bypass the Twig sandbox through the misuse of Asset::getMimeType transformations. By manipulating the 'as' or 'on' keys without proper filtration, attackers can take advantage of Craft::createObject to introduce malicious code, allowing them to execute arbitrary commands in the context of the web user. This vulnerability necessitates immediate attention to secure your Craft CMS environment.

Affected Version(s)

cms 5.0.0 < 5.11.0

cms 5.11.0

References

https://github.com/craftcms/cms/security/advisories/GHSA-...
vendor-advisory
https://www.vulncheck.com/advisories/craft-cms-5.0.0-befo...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

manus-use
.