Threats Tagged 'ghsa-957r-qf9p-67xw'

Craft CMS versions from 5.9.0 introduced a vulnerability where the Twig `create()` function allows instantiation of arbitrary PHP classes from template code, with only a limited blocklist. The class `SplFileObject` is not blocked, enabling an admin user to read arbitrary files on the server by configuring entry type title or URI formats in non-sandboxed template contexts. This can expose sensitive files such as `.env` containing security keys and database credentials. Exploitation requires admin access and the configuration setting `allowAdminChanges` to be true, which is typically disabled in production. The vulnerability does not affect sandboxed contexts like system email templates. The severity is rated medium due to the required privileges and configuration.