CVE-2026-112772 craftcms CVE debrief

Who should care

Defenders responsible for Craft CMS installations should assess exposure and prioritize upgrades or mitigations. This includes verifying the version of Craft CMS and checking for any potential vulnerabilities. Defenders should also review compensating controls for exposed systems and monitor for suspicious activity.

Why it matters

CVE-2026-112772 is a remote code execution vulnerability in Craft CMS versions from 5.0.0 before 5.11.0. Defenders should prioritize verifying exposure and upgrading to version 5.11.0 or later.

• Potential code execution as web user
• Escalation of privileges for authenticated users
• Possible malicious behavior or event handler attachment

Technical summary

The vulnerability allows authenticated Control Panel users to escape the Twig sandbox via Asset::getMimeType transforms, enabling attackers to attach malicious behaviors or event handlers that execute code as the web user. This is a remote code execution vulnerability in Craft CMS versions from 5.0.0 before 5.11.0. The vulnerability has a CVSS score of 8.7 and is considered HIGH severity. The CVE record and NVD entry provide details on the vulnerability, but defenders should verify exposure and prioritize upgrades or mitigations.

Defensive priority

Defenders should prioritize verifying exposure of Craft CMS installations and upgrading to version 5.11.0 or later. Inventory checks and monitoring for suspicious activity are recommended.

Recommended defensive actions

• Verify Craft CMS installations for exposure
• Upgrade to version 5.11.0 or later
• Monitor for suspicious activity
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Plan vendor-supported updates or mitigations through normal change control

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, the scope of affected versions and potential impact require verification from official sources. The vulnerability allows authenticated Control Panel users to escape the Twig sandbox via Asset::getMimeType transforms, enabling attackers to attach malicious behaviors or event handlers that execute code as the web user. The CVE Program record and NVD detail page are official sources that provide information on the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.