CVE-2026-72779
Received Received - Intake

Arbitrary File Read in Craft CMS

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: VulnCheck

Description
Craft CMS 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2 contain an arbitrary file read vulnerability. The create() Twig function restricts class instantiation using a 5-entry blocklist that does not include SplFileObject, allowing an authenticated administrator (with allowAdminChanges=true) to configure a malicious entry type title or URI format that instantiates SplFileObject in a non-sandboxed template context. When a user subsequently creates an entry in the affected section, arbitrary files on the server (such as .env containing the security key and database credentials) are read and rendered as entry titles.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-72779
EUVD
EUVD-2026-56103

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
craftcms craft_cms to 5.10.6 (exc)
craftcms craft_cms to 4.18.2 (exc)
craftcms craft_cms From 5.0.0-rc1 (inc) to 5.10.5 (inc)
craftcms craft_cms From 4.0.0-rc1 (inc) to 4.18.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-184 The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-72779 is an arbitrary file read vulnerability in Craft CMS versions 5.0.0-RC1 through 5.10.5 and 4.0.0-RC1 through 4.18.1. The create() Twig function has a blocklist that excludes SplFileObject, allowing authenticated administrators to exploit it by setting a malicious entry type title or URI format. This forces the system to read arbitrary files like .env files containing sensitive data when users create entries.

Detection Guidance

Check Craft CMS versions for affected ranges (5.0.0-RC1 to 5.10.5 or 4.0.0-RC1 to 4.18.1). Inspect admin settings for allowAdminChanges=true and review entry type configurations for malicious SplFileObject usage. Look for unexpected file reads in logs or entry titles containing sensitive data.

Impact Analysis

An attacker with admin access and allowAdminChanges=true could read sensitive files on the server, such as .env files containing security keys and database credentials. This could lead to unauthorized data access, potential data breaches, or further system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade Craft CMS to versions 5.10.6 or 4.18.2 or later. Disable allowAdminChanges if enabled. Review and remove any suspicious entry type configurations. Restrict admin access and monitor for unauthorized file reads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72779. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart