GHSA-957R-QF9P-67XW: Arbitrary File Read via SplFileObject in Craft CMS Twig Extension
Vulnerability ID: GHSA-957R-QF9P-67XW
CVSS Score: 4.9
Published: 2026-08-06
An information disclosure vulnerability in Craft CMS allows users with administrative or non-sandboxed template-authoring privileges to read arbitrary system and configuration files. The issue stems from an incomplete class instantiation blocklist in the Twig template extension, which omitted PHP's built-in SplFileObject class.
TL;DR
Craft CMS administrators with template capabilities can read sensitive server files (such as .env and system configurations) by abusing an omission in the dynamic class helper's blocklist to instantiate PHP's SplFileObject.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-470
- Attack Vector: Network / Authenticated Administrative User
- Vulnerability Class: Unsafe Reflection
- CVSS Score: 4.9
- Exploit Status: poc
- KEV Status: not listed
Affected Systems
- Craft CMS 4.x
- Craft CMS 5.x
-
Craft CMS: >= 4.0.0, < 4.18.2 (Fixed in:
4.18.2) -
Craft CMS: >= 5.0.0, < 5.10.6 (Fixed in:
5.10.6)
Code Analysis
Commit: 7c96fd7
Add SplFileObject to class blocklist inside twig extensions for 5.x branch
Commit: 87978f1
Add SplFileObject to class blocklist inside twig extensions for 4.x branch
Exploit Details
- GitHub Advisory Database: Proof of concept using standard Twig iteration to leak the server .env file.
Mitigation Strategies
- Add SplFileObject to the dynamic class instantiation blocklist inside Twig extensions
- Restrict the template-authoring privileges to trusted administrative accounts only
- Configure PHP open_basedir restrictions to prevent file system access outside the application root directory
Remediation Steps:
- Identify the current active version of Craft CMS
- If running Craft CMS 4.x, upgrade the installation to at least version 4.18.2
- If running Craft CMS 5.x, upgrade the installation to at least version 5.10.6
- Deploy the updated codebase and verify that Twig dynamic class instantiation rejects SplFileObject
References
Read the full report for GHSA-957R-QF9P-67XW on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)