CVE-2026-112771: Exposure of Sensitive Information to an Unauthorized Actor in craftcms cms
Description
Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contains a Twig sandbox allowlist bypass because the column, contains, filterByValue, index, where, and multisort filters resolve caller-supplied keys via ArrayHelper::getValue() without consulting the sandbox security policy. Authenticated Control Panel users can supply dot-path keys to traverse the craft global and disclose the securityKey, database credentials, and auth tokens.
CVSS v4.0
Score 7.1high
Affected software
craftcms
cms
craftcms
cms
pkg:github/craftcms/cmsRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-112771 is a vulnerability in Craft CMS where the Twig sandbox allowlist can be bypassed. The issue arises because filters like column, contains, filterByValue, index, where, and multisort resolve user-supplied keys via ArrayHelper::getValue() without enforcing the sandbox security policy. This allows authenticated Control Panel users to supply dot-path keys that traverse the craft global object and disclose sensitive data including securityKey, database credentials, and auth tokens.
Potential Impact
An authenticated user with Control Panel access can exploit this vulnerability to access sensitive internal information such as security keys, database credentials, and authentication tokens. This exposure could lead to further compromise of the system's confidentiality and integrity.
Mitigation Recommendations
A fix is available in Craft CMS versions 4.18.8 and later, and 5.11.0 and later. Users should upgrade to these versions to remediate the vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-19T18:10:49.940Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad670ea2cdf04f65685174c
Added to database: 10/19/2026, 19:35:06 UTC
Last enriched: 10/19/2026, 19:48:46 UTC
Last updated: 10/19/2026, 22:27:02 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.