The vulnerability arises from the `create()` Twig function introduced in Craft CMS 5.9.0, which allows instantiation of arbitrary PHP classes from template code but restricts only five classes via a blocklist. Since `SplFileObject` is not blocked, an admin user can instantiate it with a file path argument to read arbitrary files on the server. This is exploitable in non-sandboxed template contexts such as entry type title and URI formats, where the file contents are rendered as entry titles visible to users with entry view permissions. The vulnerability requires admin-level access and `allowAdminChanges=true`, which is usually disabled in production environments. The Twig sandbox blocks this function in system email templates, limiting the scope of exploitation. The impact includes exposure of sensitive files like `.env` containing security keys and database credentials.

An attacker or admin with control over entry type settings can read arbitrary files on the server filesystem, including sensitive configuration files such as `.env` that contain security keys, database credentials, and API keys. The file contents are exposed as entry titles visible to users with permission to view entries in the affected section. The impact is limited by the need for admin access and the `allowAdminChanges` setting being enabled, which is not recommended in production environments.

A patch is available for this vulnerability. It is recommended to apply the official fix provided by the vendor. Additionally, ensure that the `allowAdminChanges` configuration setting is set to false in production environments to prevent unauthorized entry type configuration changes. The Twig sandbox already blocks the `create()` function in system email templates, so no action is required for sandboxed contexts.