CVE-2026-112772

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0 through 5.10.x

Description Authenticated Control Panel users can achieve remote code execution by escaping the Twig sandbox through Asset::getMimeType transforms. This occurs because the as or on keys are passed unfiltered to the createObject() function, allowing attackers to attach malicious behaviors or event handlers that execute code with the privileges of the web user.

Recommendations Update Craft CMS to version 5.11.0 or later.