CVE-2026-72779

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0-RC1 through 5.10.5 Craft CMS versions 4.0.0-RC1 through 4.18.1

Description An arbitrary file read issue exists where the create() Twig function fails to include SplFileObject in its class instantiation blocklist. This allows an authenticated administrator with allowAdminChanges=true to configure a malicious entry type title or URI format that instantiates SplFileObject within a non-sandboxed template context. Consequently, when a user creates an entry in the affected section, sensitive server files, such as the .env file containing security keys and database credentials, can be read and rendered as entry titles.

Recommendations Update Craft CMS versions 5.0.0-RC1 through 5.10.5 to version 5.10.6. Update Craft CMS versions 4.0.0-RC1 through 4.18.1 to version 4.18.2.