Advisory · CVE-2026-112770
Craft CMS Twig group filter lets authenticated panel users invoke arbitrary callables for code execution
Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 invokes non-string arrow arguments to the Twig group filter as callables without the checkArrow guard, so authenticated Control Panel users can write a webshell via FileHelper::writeToFile and execute code as the web user. CVSS 3.1 8.8.
- Vendor
- Craft CMS
- Product
- Craft CMS
- Identifier / CWE
- CVE-2026-112770
CWE-94 - Action timing
- Immediate
Explain it like I’m five
One Twig filter forgets to check the callback it is handed, so a panel user can hand it a file-writing helper and leave a webshell in the webroot.
- 01Panel access held
An authenticated Control Panel user reaches a template path that renders the Twig group filter, with the Twig sandbox enabled.
- 02Array callable supplied
The attacker passes an array callable such as FileHelper::writeToFile as the filter arrow argument.
- 03Guard skipped
The group filter invokes the callable without the checkArrow guard the other arrow filters apply.
- 04Webshell written
A file is written to the webroot and requested over HTTP, giving code execution as the web user.
What happened
Craft CMS disclosed CVE-2026-112770 (CWE-94) for 4.x before 4.18.8 and 5.x before 5.11.0: the Twig group filter invokes non-string arrow arguments as callables without the checkArrow guard used by other arrow-accepting filters, so an array callable such as FileHelper::writeToFile can write a webshell to the webroot.
The vendor advisory states the reachability gate plainly: the Twig sandbox must be enabled (enableTwigSandbox, off by default) and the attacker needs authenticated Control Panel access, reachable by lower-privilege panel editors through element-select condition rules. Per the vendor affected data, 4.18.8 and 5.11.0 are the first unaffected releases for their lines.
What to do
- Inventory Craft CMS sites and note whether each runs the 4.x or 5.x line.
- Upgrade affected sites to 4.18.8 or later on the 4.x line, or 5.11.0 or later on the 5.x line using the project release guidance.
- Restrict Control Panel access to trusted networks and named administrators while remediation is underway.
- Hunt for new PHP files in the webroot, template or condition-rule edits by lower-privilege panel users, and FileHelper write activity.
- Verify the deployed version after updating, not just that an update ran.
Management note
The sandbox setting is the difference between a theoretical and a reachable flaw here, which cuts both ways: sites that enabled the sandbox for untrusted templates are exactly the sites that need this patch first.