CVE-2026-112770: Improper Control of Generation of Code ('Code Injection') in craftcms cms

CVE-2026-112770 is a remote code execution vulnerability affecting Craft CMS 4.x versions prior to 4.18.8 and 5.x versions prior to 5.11.0. The issue exists in the Twig group filter, which improperly invokes non-string arrow arguments as callables without the checkArrow guard used by other arrow-accepting filters. Authenticated users with control panel access can exploit this by passing an array-callable, such as FileHelper::writeToFile, via element-select condition rules. This allows them to write a webshell to the webroot and execute arbitrary code with the privileges of the web user.

An authenticated control panel user can achieve remote code execution on the affected Craft CMS installations. This enables the attacker to write files to the webroot and execute arbitrary code as the web server user, potentially leading to full system compromise depending on the server configuration and privileges.

A fix is available in Craft CMS versions 4.18.8 and later, and 5.11.0 and later. Users should upgrade to these versions to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.