Vulnerability in Craftcms Cms
CVE-2026-72779
Craft CMS 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2 contain an arbitrary file read vulnerability. The create() Twig function restricts class instantiation using a 5-entry blocklist that does not include SplFileObject, allowing an authenticated administrator (with allowAdminChanges=true) to configure a malicious entry type title or URI format that instantiates SplFileObject in a non-sandboxed template context. When a user subsequently creates an entry in the affected section, arbitrary files on the server (such as .env containing the security key and database credentials) are read and rendered as entry titles.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.004 (28.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 29th percentile — 28.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.004 · change: +0.002
Affected products
- Craftcms Cms — versions 5.0.0-RC1, 5.10.6, 4.0.0-RC1
Weakness classification (CWE)
References
- github.com/craftcms/cms/security/advisories/GHSA-957r-qf9p-67xw (vendor-advisory)
- www.vulncheck.com/advisories/craft-cms-rc1-before-arbitrary-file-read-via-splfi… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-72779?
- CVE-2026-72779 is a medium-severity vulnerability in Craftcms Cms, classified under Incomplete List of Disallowed Inputs. CVSS score: 4.5/10. Published 2026-08-11.
- How severe is CVE-2026-72779?
- Medium severity. CVSS v3 base score is 4.5 out of 10.