CVE-2026-112771

Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filters

State: Published
Severity: 7.1 High
Published: Oct 19, 2026
Updated: Oct 20, 2026
Reserved: Oct 19, 2026

Description

Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contains a Twig sandbox allowlist bypass because the column, contains, filterByValue, index, where, and multisort filters resolve caller-supplied keys via ArrayHelper::getValue() without consulting the sandbox security policy. Authenticated Control Panel users can supply dot-path keys to traverse the craft global and disclose the securityKey, database credentials, and auth tokens.

Scores

CVSS	Score	Vector	Source
4.0	7.1 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	VulnCheck

Weaknesses

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

Product	Versions
cmscraftcms	4.0.0 to before 4.18.8Affected 4.18.8Not affected
cmscraftcms	5.0.0 to before 5.11.0Affected 5.11.0Not affected

References

GitHub Security Advisory (GHSA-j697-8x93-7mp2)vendor-advisory
VulnCheck Advisory: Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filtersthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.