Arbitrary File Read Vulnerability in Craft CMS by Craft

CVE-2026-72779

What is CVE-2026-72779?

Craft CMS versions 5.0.0-RC1 prior to 5.10.6 and 4.0.0-RC1 prior to 4.18.2 are prone to an arbitrary file read vulnerability. This issue arises due to the create() Twig function containing a limited blocklist for class instantiation, which mistakenly excludes the SplFileObject class. An authenticated administrator with permission to change settings can maliciously configure entry titles or URI formats that utilize SplFileObject in an unsafe template environment. Consequently, when an entry is created, sensitive files, such as .env files containing security keys and database credentials, may be exposed and rendered as entry titles, leading to significant security risks.

References