Duplicate Advisory: Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts

Craft CMS versions 4.0.0-RC1 before 4.18.2 and 5.0.0-RC1 before 5.10.6 have an arbitrary file read vulnerability via the create() Twig function. The vulnerability arises because the function restricts class instantiation with a limited blocklist that omits SplFileObject. An authenticated administrator with allowAdminChanges=true can configure a malicious entry type title or URI format that instantiates SplFileObject in a non-sandboxed template context. When a user creates an entry in the affected section, arbitrary files on the server, including sensitive files like .env, can be read and exposed as entry titles.

An authenticated administrator with allowAdminChanges=true can exploit this vulnerability to read arbitrary files on the server, including sensitive configuration files such as .env that may contain security keys and database credentials. This leads to confidentiality breaches but does not affect integrity or availability. The vulnerability requires high privileges (administrator) and user interaction (creating an entry).

No explicit patch links are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until patched, restrict administrator permissions and the allowAdminChanges setting to trusted users only. Monitor vendor advisories for updates and apply official fixes once available.