CVE-2026-112770

Craft CMS before 4.18.8 and 5.11.0 Authenticated RCE via Twig group Filter Array-Callable

State: Published
Severity: 8.7 High
Published: Oct 19, 2026
Updated: Oct 22, 2026
Reserved: Oct 19, 2026

Description

Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in the Twig group filter, which invokes non-string arrow arguments as callables without the checkArrow guard used by other arrow-accepting filters. Authenticated control panel users can pass an array-callable such as FileHelper::writeToFile via element-select condition rules to write a webshell to the webroot and execute code as the web user.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	VulnCheck
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	VulnCheck

Weaknesses

CWE-94 Improper Control of Generation of Code ('Code Injection')

Affected Products

Product	Versions
cmscraftcms	4.0.0 to before 4.18.8Affected 4.18.8Not affected
cmscraftcms	5.0.0 to before 5.11.0Affected 5.11.0Not affected

References

GitHub Security Advisory (GHSA-xmwr-88vw-5ghh)vendor-advisory
VulnCheck Advisory: Craft CMS before 4.18.8 and 5.11.0 Authenticated RCE via Twig group Filter Array-Callablethird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.