Key points
- The flaw affects Craft CMS versions starting from 5.0.0 up to, but not including, 5.11.0.
- National Vulnerability Database rates the issue as high severity with a CVSS score of 8.7.
- Attackers must possess valid Control Panel credentials to exploit the remote code execution vector.
Craft CMS users running versions older than 5.11.0 must update immediately. The National Vulnerability Database records CVE-2026-112772 as a high-severity vulnerability. This security issue allows authenticated users within the Control Panel to execute arbitrary code on the hosting server. The flaw exists in versions released from 5.0.0 onward.
In plain English
The vulnerability involves the Twig template engine’s sandbox. An attacker with Control Panel access can manipulate Asset::getMimeType transforms. By supplying specific keys labeled 'as' or 'on', the malicious input bypasses standard filters. These inputs are passed directly to Craft::createObject without validation.
The background
According to the NVD record, the underlying weakness is classified as CWE-94. The unfiltered input allows attackers to attach malicious behaviors or event handlers. These handlers execute code with the same privileges as the web server user. This effectively grants the attacker full control over the application logic.
What changes now
The vendor has released version 5.11.0 to address this issue. Users are advised to upgrade their installations to this specific version. The update patches the input handling within the Asset module. This prevents the unauthorized execution of code via the Twig sandbox escape.
Who needs to act first
Teams should prioritize updating public-facing sites that accept user-generated content. Check whether any development or staging environments are also affected. Back up all databases and files before applying the update. Test the patched version in an isolated environment first. Verify that existing custom modules function correctly after the upgrade. This reduces the risk of breaking live services during the remediation process.
Background: Sandbox escape vulnerabilities
Prevent sandbox escapes by enforcing strict capability drops, validating all IPC data, and auditing shared resources. Sandboxes do not replace input validation. You must assume the sandbox boundary will be crossed and limit the damage through least privilege and rigorous separation of duties.
Read the full guide: Stop Sandbox Escapes: Prevention Strategies That Actually Work
What to do and how to stay safe: Craft CMS
- Verify your current Craft CMS version against the affected range before taking action.
- Ensure you have a complete backup of your database and site files before upgrading.
- Review your Control Panel user accounts to identify any unauthorized or unnecessary administrative privileges.
- Monitor server logs for unusual activity or unexpected code execution attempts while planning the update.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-112772?
The National Vulnerability Database assigns a CVSS score of 8.7, which is rated as high severity.
Do attackers need to log in to exploit this flaw?
Yes, the vulnerability requires an attacker to have valid credentials for the Craft CMS Control Panel.
Which specific versions of Craft CMS are vulnerable?
Versions from 5.0.0 through any version prior to 5.11.0 are affected by this security issue.
