{"uuid": "246cccd3-4912-4506-b6e4-8dae5888d2d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-957R-QF9P-67XW", "type": "seen", "source": "https://gist.github.com/alon710/40498cd7ab099bfd269056fcd2fad5d7", "content": "# GHSA-957R-QF9P-67XW: GHSA-957R-QF9P-67XW: Arbitrary File Read via SplFileObject in Craft CMS Twig Extension\n\n> **CVSS Score:** 4.9\n> **Published:** 2026-08-06\n> **Full Report:** https://cvereports.com/reports/GHSA-957R-QF9P-67XW\n\n## Summary\nAn information disclosure vulnerability in Craft CMS allows users with administrative or non-sandboxed template-authoring privileges to read arbitrary system and configuration files. The issue stems from an incomplete class instantiation blocklist in the Twig template extension, which omitted PHP's built-in SplFileObject class.\n\n## TL;DR\nCraft CMS administrators with template capabilities can read sensitive server files (such as .env and system configurations) by abusing an omission in the dynamic class helper's blocklist to instantiate PHP's SplFileObject.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-470\n- **Attack Vector**: Network / Authenticated Administrative User\n- **Vulnerability Class**: Unsafe Reflection\n- **CVSS Score**: 4.9\n- **Exploit Status**: poc\n- **KEV Status**: not listed\n\n## Affected Systems\n\n- Craft CMS 4.x\n- Craft CMS 5.x\n- **Craft CMS**: >= 4.0.0, < 4.18.2 (Fixed in: `4.18.2`)\n- **Craft CMS**: >= 5.0.0, < 5.10.6 (Fixed in: `5.10.6`)\n\n## Mitigation\n\n- Add SplFileObject to the dynamic class instantiation blocklist inside Twig extensions\n- Restrict the template-authoring privileges to trusted administrative accounts only\n- Configure PHP open_basedir restrictions to prevent file system access outside the application root directory\n\n**Remediation Steps:**\n1. Identify the current active version of Craft CMS\n2. If running Craft CMS 4.x, upgrade the installation to at least version 4.18.2\n3. If running Craft CMS 5.x, upgrade the installation to at least version 5.10.6\n4. Deploy the updated codebase and verify that Twig dynamic class instantiation rejects SplFileObject\n\n## References\n\n- [GitHub Advisory: Craft CMS Arbitrary File Read](https://github.com/advisories/GHSA-957R-QF9P-67XW)\n- [Fix Commit (5.x Branch)](https://github.com/craftcms/cms/commit/7c96fd73df936a10e8f85ae6ef61a9fc3f277c12)\n- [Fix Commit (4.x Branch)](https://github.com/craftcms/cms/commit/87978f11c8f986c40ef41b941d79547230c4d6d9)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-957R-QF9P-67XW) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-07T00:05:24.914689Z"}