CVE-2026-112772: Improper Control of Generation of Code ('Code Injection') in craftcms cms

CVE-2026-112772 is a remote code execution vulnerability in Craft CMS affecting versions 5.0.0 up to but not including 5.11.0. Authenticated users with Control Panel access can exploit this flaw by supplying specially crafted 'as' or 'on' keys to the Asset::getMimeType transforms, which are passed without filtering to the Craft::createObject method. This allows attackers to attach malicious behaviors or event handlers that execute arbitrary code within the context of the web user, effectively escaping the Twig sandbox intended to restrict code execution.

Successful exploitation allows authenticated Control Panel users to execute arbitrary code on the server with the privileges of the web user. This can lead to full compromise of the application environment, data exposure, or further attacks within the hosting infrastructure. The vulnerability requires authentication but no user interaction beyond that, and has a high severity score of 8.7.

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Control Panel user access to trusted personnel only and monitor for suspicious activity related to Asset::getMimeType usage.