Craft CMS versions 4.0.0-RC1 up to but not including 4.18.2, and 5.0.0-RC1 up to but not including 5.10.6, contain a vulnerability in the Twig `create()` function that allows an admin user to read arbitrary files on the server. This is possible because the `create()` function can instantiate PHP classes like SplFileObject, which is not blocked, enabling file reads from non-sandboxed template contexts such as entry type title and URI formats. Exploitation requires admin access and the configuration setting `allowAdminChanges` to be true, which is typically disabled in production. The vulnerability exposes sensitive files like `.env` containing security keys and database credentials. The Twig sandbox blocks this function in system email templates, limiting the attack surface. A patch is available for this vulnerability.