CVE-2026-109304: Exposure of Sensitive Information to an Unauthorized Actor in craftcms cms

The vulnerability in Craft CMS arises from insufficient blocking in the Twig create() class, specifically the omission of DOMDocument from the blocklist. This allows attackers who can control the entry-type title format to invoke create('DOMDocument').loadHTMLFile() and access local file contents via textContent. The flaw affects Craft CMS versions 4.0.0 up to but not including 4.18.7 and 5.0.0 up to but not including 5.10.14. The vulnerability enables arbitrary file read exposure to unauthorized users with entry viewing permissions but not admin privileges.

Unauthorized users with the ability to set entry-type title formats can read local files on the server, potentially exposing sensitive information. This can lead to information disclosure without requiring administrative privileges. The vulnerability does not require user interaction and has a medium severity rating with a CVSS 4.0 score of 6.9.

A fix is available in Craft CMS versions 4.18.7 and later, and 5.10.14 and later. Users should upgrade to these versions to remediate the vulnerability. No additional mitigation steps are indicated beyond applying the official patches.