Craft CMS Blocklist Bypass via Case-Insensitive Class Resolution

Executive Summary

Craft CMS versions 4.x before 4.18.8 and 5.x before 5.11.0 have a case-sensitivity bypass in the Twig create() function. The blocklist for class names is case-sensitive, but PHP class resolution is not. Attackers with template execution rights can bypass restrictions by using lowercase class names like splfileobject to instantiate SplFileObject, allowing them to read .env secrets or write PHP files for remote code execution.

Useful 0 Not Useful 0

Detection Guidance

Check Craft CMS version with: composer show craftcms/cms or check the admin panel version. If running 4.0.0-4.18.7 or 5.0.0-5.10.9, the system is vulnerable. Review template files for use of the Twig create() function with class names like splfileobject.

Useful 0 Not Useful 0

Impact Analysis

If you are a Craft CMS administrator or user with template execution rights, an attacker could exploit this to read sensitive files such as .env files containing credentials. They could also write malicious PHP files to the webroot, leading to remote code execution and full system compromise.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, such as credentials or personal information stored in .env files. This may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information, potentially resulting in legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Craft CMS to version 4.18.8 or later for 4.x, or 5.11.0 or later for 5.x. Remove template execution rights from untrusted users. Audit templates for suspicious create() calls and block unauthorized file operations.

Useful 0 Not Useful 0