GHSA-957r-qf9p-67xw: Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts
(updated )
The create() Twig function (introduced in 5.9.0) allows instantiation of arbitrary PHP classes from template code, restricted only by a 5-entry blocklist. SplFileObject is not in the blocklist, enabling arbitrary file read, including .env (security key, DB credentials) and the passwd file from non-sandboxed Twig template contexts, such as entry type title formats and URI formats.
The sandbox correctly blocks create() in system email templates, so this finding applies only to admin-configured, non-sandboxed contexts that require allowAdminChanges=true.
References
- github.com/advisories/GHSA-957r-qf9p-67xw
- github.com/craftcms/cms/commit/7c96fd73df936a10e8f85ae6ef61a9fc3f277c12
- github.com/craftcms/cms/commit/87978f11c8f986c40ef41b941d79547230c4d6d9
- github.com/craftcms/cms/releases/tag/4.18.2
- github.com/craftcms/cms/releases/tag/5.10.6
- github.com/craftcms/cms/security/advisories/GHSA-957r-qf9p-67xw
- nvd.nist.gov/vuln/detail/CVE-2026-72779
- www.vulncheck.com/advisories/craft-cms-rc1-before-arbitrary-file-read-via-splfileobject
Code Behaviors & Features
Detect and mitigate GHSA-957r-qf9p-67xw with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →