The vulnerability in Craft CMS arises from the `create()` Twig function introduced in version 5.9.0, which allows instantiation of arbitrary PHP classes from template code but restricts only five classes via a blocklist. The class SplFileObject is not blocked, enabling an admin user to read arbitrary files by setting entry type title or URI formats to use `create('SplFileObject', ['/path/to/file'])`. This file read can expose sensitive server files such as `.env` containing security keys and database credentials. The vulnerability requires admin-level access and the `allowAdminChanges` setting to be true, which is the default in development and staging but recommended to be false in production. The Twig sandbox prevents exploitation in system email templates and other sandboxed contexts. The vulnerability affects Craft CMS versions >=4.0.0-RC1 <4.18.2 and >=5.0.0-RC1 <5.10.6. A patch is available.

An attacker or malicious admin with control over the Craft CMS control panel and `allowAdminChanges=true` can read arbitrary files on the server filesystem by abusing the `create()` Twig function to instantiate SplFileObject. This can expose sensitive configuration files such as `.env` containing the CRAFT_SECURITY_KEY, database credentials, and API keys. The file contents are rendered as entry titles visible to users with permission to view entries, potentially leaking secrets to unauthorized users. The impact is limited by the requirement for admin access and the `allowAdminChanges` setting being enabled, which is not recommended in production environments.

A patch is available for this vulnerability and should be applied to affected Craft CMS versions. Additionally, production environments should ensure that the `allowAdminChanges` setting is set to false, which prevents entry type configuration changes and mitigates this vulnerability. The Twig sandbox already blocks the `create()` function in system email templates, so no action is required for those contexts.