{"id":"CVE-2026-112777","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-112777","summary":"Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its class-name checks are case-sensitive while PHP class resolution…","details":"Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its class-name checks are case-sensitive while PHP class resolution is not. Attackers with template-execution rights, such as Control Panel administrators, can instantiate SplFileObject via a lowercase class name to read .env secrets or write a PHP file into the webroot for remote code execution.","published":"2026-10-19T20:17:55.043","modified":"2026-10-19T20:17:55.043","cvss":{"score":7.2,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":null,"references":[{"type":"WEB","url":"https://github.com/craftcms/cms/security/advisories/GHSA-w643-x88w-6wcm"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/craft-cms-before-4.18.8-and-5.11.0-twig-create-blocklist-bypass-leading-to-rce"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-10-19T20:17:55.043"}}