CVE-2026-109304
Received Received - Intake

Arbitrary File Read in Craft CMS via DOMDocument

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 contains an arbitrary file read vulnerability because the Twig create() class blocklist does not cover DOMDocument. Attackers able to set an entry-type title format, including via project-config/apply, can use create('DOMDocument').loadHTMLFile() with textContent to expose local file contents to non-admin users who can view entries.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109304
EUVD
EUVD-2026-97606

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
craftcms cms 4.0.0
craftcms cms 5.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Craft CMS versions 4.0.0 to 4.18.6 and 5.0.0 to 5.10.13. It allows attackers to read arbitrary local files due to an incomplete blocklist in the Twig create() class. Specifically, DOMDocument is not blocked, enabling create('DOMDocument').loadHTMLFile() to expose file contents to non-admin users with entry viewing permissions.

Detection Guidance

Check Craft CMS version with composer show craftcms/cms or inspect entry-type title format settings for DOMDocument usage. Review project-config/apply logs for unauthorized file access attempts.

Impact Analysis

Non-admin users with entry viewing permissions could access sensitive local files through entry titles. Attackers could exploit this to read configuration files, user data, or other confidential information stored on the server. The impact includes unauthorized data exposure and potential further exploitation of exposed files.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Organizations may face compliance breaches, legal penalties, and reputational damage due to unauthorized data exposure.

Mitigation Strategies

Upgrade Craft CMS to version 4.18.7 or later for 4.x or 5.10.14 or later for 5.x. Review and remove any entry-type title formats using DOMDocument. Restrict non-admin user permissions to prevent entry viewing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109304. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart