[ CVE-2026-109304 · Published 12 Oct 2026 ]
Vulnerability in craftcms cms
CVSS 4.9
EPSS <1%No fix listed yet
[ Description ]Official description
Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 contains an arbitrary file read vulnerability because the Twig create() class blocklist does not cover DOMDocument. Attackers able to set an entry-type title format, including via project-config/apply, can use create('DOMDocument').loadHTMLFile() with textContent to expose local file contents to non-admin users who can view entries.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.