CyberRota Analysis
AI-GeneratedCraft CMS versions 5.0.0-RC1 through 5.10.6 and 4.0.0-RC1 through 4.18.2 are vulnerable to an arbitrary file read issue, allowing authenticated administrators to exploit the create() Twig function. This vulnerability enables the reading of sensitive server files, such as environment configuration files, which could expose critical security information. Organizations using affected Craft CMS versions, particularly those with admin users who can modify entry types, should prioritize patching to mitigate potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Craft CMS 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2 contain an arbitrary file read vulnerability. The create() Twig function restricts class instantiation using a 5-entry blocklist that does not include SplFileObject, allowing an authenticated administrator (with allowAdminChanges=true) to configure a malicious entry type title or URI format that instantiates SplFileObject in a non-sandboxed template context. When a user subsequently creates an entry in the affected section, arbitrary files on the server (such as .env containing the security key and database credentials) are read and rendered as entry titles.