Advisory · CVE-2026-112772
Craft CMS Asset transform injection lets authenticated panel users escape the Twig sandbox
Craft CMS 5.0.0 before 5.11.0 passes Asset::getMimeType transform keys unfiltered to Craft::createObject, so authenticated Control Panel users can attach Yii behaviors or event handlers through as or on keys and execute code as the web user. CVSS 3.1 8.8.
- Vendor
- Craft CMS
- Product
- Craft CMS
- Identifier / CWE
- CVE-2026-112772
CWE-94 - Action timing
- Immediate
Explain it like I’m five
A picture helper passes your extra settings straight into the object factory, so two magic keys in the settings become code that runs as the web server.
- 01Panel access held
An authenticated Control Panel user reaches a sandboxed template path using the Asset::getMimeType transform, with the Twig sandbox enabled.
- 02Transform keys supplied
The attacker adds as or on keys to the transform array.
- 03Object built uncleansed
The transform reaches Craft::createObject after only the class key is rejected, so the extra keys attach a behavior or event handler.
- 04Handler fires
The attached handler runs during object construction, giving code execution as the web user.
What happened
Craft CMS disclosed CVE-2026-112772 (CWE-94) for versions 5.0.0 before 5.11.0: Asset::getMimeType passes a caller-supplied transform array to ImageTransforms::normalizeTransform(), which rejects only the class key before calling Craft::createObject, so surviving as or on keys attach attacker-controlled Yii behaviors or event handlers.
The vendor advisory states the reachability gate plainly: the Twig sandbox must be enabled (enableTwigSandbox, off by default) and the attacker needs authenticated Control Panel access. Per the vendor affected data in the NVD record, 5.11.0 is the first unaffected release.
What to do
- Inventory Craft CMS sites and note whether each runs the 4.x or 5.x line.
- Upgrade affected sites to 5.11.0 or later using the project release guidance.
- Restrict Control Panel access to trusted networks and named administrators while remediation is underway.
- Hunt for image transform definitions or templates carrying as or on keys, and unexpected event handler or behavior attachments.
- Verify the deployed version after updating, not just that an update ran.
Management note
This is one caller in a recurring Craft object-injection family. Patching closes this sink; the durable lesson is that any template-reachable helper feeding createObject deserves the same suspicion in code review.