Advisory · CVE-2026-112777
Craft CMS Twig create() blocklist can be bypassed with a lowercase class name
Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 checks Twig create() class names case-sensitively while PHP resolves classes case-insensitively, so attackers with template-execution rights can instantiate SplFileObject in lowercase to read .env secrets or write a PHP file for code execution. CVSS 4.0 8.7 (CVSS 3.1 7.2).
- Vendor
- Craft CMS
- Product
- Craft CMS
- Identifier / CWE
- CVE-2026-112777
CWE-184 - Action timing
- Immediate
Explain it like I’m five
The guard checks names in one capitalisation while PHP happily accepts any, so spelling the forbidden class in lowercase walks straight past the list.
- 01Template rights held
An attacker holds template-execution rights, such as a Control Panel administrator in the default configuration.
- 02Lowercase name supplied
The attacker calls the Twig create() function with a lowercase class name such as splfileobject.
- 03Blocklist bypassed
The case-sensitive prefix and suffix checks miss the name, while PHP resolves it to SplFileObject.
- 04Files read or written
The attacker reads files such as .env or writes a PHP file into the webroot and requests it for code execution.
What happened
Craft CMS disclosed CVE-2026-112777 (CWE-184) for 4.x before 4.18.8 and 5.x before 5.11.0: the blocklist guarding the Twig create() function tests class names with case-sensitive string checks, while PHP class resolution is case-insensitive, and SplFileObject was removed from the surviving case-insensitive blocklist when the prefix check was added, so a lowercase name instantiates it unchecked.
The vendor advisory limits the actor to attackers with template-execution rights, such as Control Panel administrators in the default configuration, and names .env reads (including the Craft security key and database credentials) and webroot PHP writes as the demonstrated impact. Per the vendor affected data, 4.18.8 and 5.11.0 are the first unaffected releases for their lines.
What to do
- Inventory Craft CMS sites and note whether each runs the 4.x or 5.x line.
- Upgrade affected sites to 4.18.8 or later on the 4.x line, or 5.11.0 or later on the 5.x line using the project release guidance.
- Restrict Control Panel access to trusted networks and named administrators while remediation is underway.
- Hunt for template use of the create() function with unusually cased class names, .env reads by the web user, and new PHP files in the webroot.
- Verify the deployed version after updating, not just that an update ran.
Management note
A blocklist that disagrees with the language runtime about identity is a bypass waiting for a spelling change. Patch, and rotate the Craft security key and database credentials on any site where template rights are widely held.