Blocklist Bypass in Craft CMS Twig Function Exposes Sensitive Information

CVE-2026-112777

What is CVE-2026-112777?

A vulnerability in Craft CMS versions prior to 4.18.8 and 5.11.0 allows attackers with certain template-execution rights to bypass class-name checks due to case sensitivity issues. This flaw in the Twig create() function can be exploited to instantiate SplFileObject using a lowercase class name, enabling unauthorized access to sensitive .env files or allowing the writing of PHP files into the webroot. This could lead to significant security risks, including remote code execution.

References