Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: craftcms cms 4.18.8 Clear all filters
TI-2026-76616 CVE-2026-112777 · GHSA-f7pv-pv9r-vg93

Craft CMS Twig create() blocklist bypass allows remote code execution

Priority MEDIUM 45

Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its class-name checks are case-sensitive while PHP class resolution is not.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00612 Published 2026-10-19 Fixed in 4.18.8, 5.11.0 CWE-184
TI-2026-76610 CVE-2026-112771 · GHSA-238j-2hq5-wrgg

Twig sandbox allowlist bypass in Craft CMS exposes secrets

Priority LOW 31

Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contains a Twig sandbox allowlist bypass because the column, contains, filterByValue, index, where, and multisort filters resolve caller-supplied keys via ArrayHelper…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00317 Published 2026-10-19 Fixed in 4.18.8, 5.11.0 CWE-200
TI-2026-76609 CVE-2026-112770 · GHSA-xw77-mfcc-54f8

Code injection in Craft CMS Twig group filter allows remote code execution

Priority MEDIUM 41

Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in the Twig group filter, which invokes non-string arrow arguments as callables without the checkArrow guard used by other…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00712 Published 2026-10-19 Fixed in 4.18.8, 5.11.0 CWE-94