CVE-2026-112772
Deferred Deferred - Pending Action

Authenticated RCE via Twig Sandbox Escape in Craft CMS

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulnCheck

Description
Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox via Asset::getMimeType transforms. Attackers can supply 'as' or 'on' keys passed unfiltered to Craft::createObject, attaching malicious behaviors or event handlers that execute code as the web user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-20
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112772
EUVD
EUVD-2026-104578

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
craftcms cms 5.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Craft CMS versions 5.0.0 to 5.11.0 have a remote code execution flaw. Authenticated Control Panel users can escape the Twig sandbox via Asset::getMimeType transforms. Attackers supply 'as' or 'on' keys in a transform array passed to Craft::createObject, injecting malicious behaviors or event handlers that execute code as the web user.

Detection Guidance

Check Craft CMS version with: composer show craftcms/cms. If version is between 5.0.0 and 5.10.x, the system is vulnerable. Review logs for unusual Asset::getMimeType() calls or Twig sandbox bypass attempts.

Impact Analysis

An attacker with Control Panel access could execute arbitrary code on the server running Craft CMS. This could lead to full system compromise, data theft, or unauthorized modifications. The impact depends on server permissions but is rated high severity due to potential for complete control.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR (data protection) and HIPAA (health data security). Organizations using affected versions may face compliance breaches, regulatory penalties, and loss of trust due to potential data exposure.

Mitigation Strategies

Upgrade Craft CMS to version 5.11.0 or later immediately. Disable the Twig sandbox if not required. Restrict Control Panel access to trusted users only. Monitor for unauthorized code execution attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112772. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart