The vulnerability in Craft CMS arises from an incomplete blocklist in the create() Twig function that restricts class instantiation. The blocklist omits SplFileObject, allowing an authenticated administrator with allowAdminChanges=true to instantiate this class in a non-sandboxed template context. By configuring a malicious entry type title or URI format, the attacker can cause arbitrary files on the server, such as sensitive configuration files (.env), to be read and displayed as entry titles when users create entries in the affected section. This leads to exposure of sensitive information stored on the server.

An authenticated administrator can read arbitrary files on the server, including sensitive files like .env that contain security keys and database credentials. This exposure can lead to further compromise of the system and sensitive data leakage. The vulnerability requires administrative privileges with allowAdminChanges enabled, limiting the attack surface to trusted users with elevated permissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access and disable allowAdminChanges if possible to reduce risk. Monitor vendor communications for updates and apply patches promptly once released.