CVE WATCH / VULNERABILITY DETAIL
CVE-2026-112777
HIGHCVSS 7.2NVD feed
Published 19 October 2026 · tracked since 20 October 2026
Description
Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its class-name checks are case-sensitive while PHP class resolution is not. Attackers with template-execution rights, such as Control Panel administrators, can instantiate SplFileObjec
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog