Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2026-109304

Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 Arbitrary File Read via Twig create() DOMDocument

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 contains an arbitrary file read vulnerability because the Twig create() class blocklist does not cover DOMDocument. Attackers able to set an entry-type title format, including via project-config/apply, can use create('DOMDocument').loadHTMLFile() with textContent to expose local file contents to non-admin users who can view entries.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

craftcms cms

Default version status: unaffected

  • 4.0.0 to < 4.18.7affected
  • 4.18.7unaffected

craftcms cms

Default version status: unaffected

  • 5.0.0 to < 5.10.14affected
  • 5.10.14unaffected

References