CVE-2026-72779 craftcms CVE debrief

Who should care

Defenders responsible for Craft CMS installations, security teams, and administrators should assess exposure and prioritize remediation. This includes operators managing affected platforms, vulnerability management teams, and security personnel responsible for monitoring and protecting sensitive assets.

Why it matters

CVE-2026-72779 is a high-severity vulnerability in Craft CMS that allows an authenticated administrator to read arbitrary files on the server, potentially leading to security key and database credential exposure.

• Verify exposure and remediate vulnerable Craft CMS installations to prevent arbitrary file reads
• Implement compensating controls to monitor and restrict access to sensitive files
• Update to versions 5.10.6 or 4.18.2 to patch the vulnerability

Technical summary

The create() Twig function in Craft CMS restricts class instantiation using a 5-entry blocklist that does not include SplFileObject, allowing an authenticated administrator to configure a malicious entry type title or URI format that instantiates SplFileObject in a non-sandboxed template context. This allows arbitrary files on the server, such as .env containing security keys and database credentials, to be read and rendered as entry titles. The vulnerability exists in Craft CMS versions 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2.

Defensive priority

Defenders should prioritize verifying exposure and remediating vulnerable Craft CMS installations.

Recommended defensive actions

• Verify exposure by checking Craft CMS versions and configurations
• Remediate vulnerable installations by updating to versions 5.10.6 or 4.18.2
• Monitor for suspicious activity and implement compensating controls
• Review official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score and affected versions. The vulnerability exists in Craft CMS versions 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2. Evidence is limited to public CVE and NVD information. Defenders should verify exposure and review official advisories for accurate affected scope and vendor guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.