CVE-2026-112771

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.0.0 through 4.18.7 Craft CMS versions 5.0.0 through 5.10.9

Description A Twig sandbox allowlist bypass exists because the column, contains, filterByValue, index, where, and multisort filters resolve caller-supplied keys via the ArrayHelper::getValue() function without consulting the sandbox security policy. Authenticated Control Panel users can utilize dot-path keys to traverse the craft global and disclose sensitive information, including the securityKey, database credentials, and auth tokens.

Recommendations Update Craft CMS versions 4.0.0 through 4.18.7 to version 4.18.8. Update Craft CMS versions 5.0.0 through 5.10.9 to version 5.11.0.