CVE-2026-112770: Craft CMS Authenticated RCE via Twig Filter Flaw

Authenticated users in affected versions of Craft CMS can now execute remote code through a specific filter flaw. This vulnerability, identified as CVE-2026-112770, stems from how the Twig group filter handles non-string arrow arguments. Unlike other filters that use the checkArrow guard, this filter invokes these arguments as callables without verification. This oversight allows malicious actors to inject executable code into the system.

How does the vulnerability work technically?

The National Vulnerability Database describes the issue as a failure to validate callable inputs within the Twig group filter. According to the record, authenticated control panel users can pass an array-callable argument, such as FileHelper::writeToFile. This specific method is often used within element-select condition rules. By injecting this callable, an attacker can write arbitrary files directly to the webroot. This effectively places a webshell on the server, granting the attacker code execution capabilities running under the privileges of the web user.

Which versions of Craft CMS are exposed?

The flaw impacts two major branches of the content management system. According to the NVD record, Craft CMS 4.x versions prior to 4.18.8 are affected. Additionally, Craft CMS 5.x versions earlier than 5.11.0 contain the same vulnerability. Organizations running these specific versions must assume their environments are exposed to this remote code execution risk. No other versions are listed as affected in the current advisory data provided by the National Vulnerability Database for this specific CVE identifier.

What is the severity and classification?

Security researchers and databases have assigned this flaw a CVSS score of 8.7. This places the vulnerability in the high severity range, indicating a significant risk to affected systems. The weakness is categorized under CWE-94, which covers code injection issues. The ability to execute code remotely, even with an authentication requirement, makes this a critical concern for security operations teams. The high score reflects the direct impact on the confidentiality, integrity, and availability of the compromised web server.

Are there any confirmed patches available?

The source material indicates that versions 4.18.8 and 5.11.0 are the boundaries for this vulnerability. This implies that updates to these versions or later are required to resolve the issue. However, the provided text does not explicitly confirm the release status or availability of these specific patches. Teams should verify whether their current installations meet or exceed these version thresholds. Until a patch is confirmed applied, the system remains vulnerable to the described exploitation path.

Detection notes

Security teams should monitor web server logs for unusual file creation events in the webroot directory, particularly those occurring shortly after control panel login. Look for POST requests containing complex array structures or unexpected callable arguments in form submissions. Alert on any new PHP or executable files appearing in directories that should only contain static assets or templates.

If a webshell is detected, immediately isolate the affected server from the network to prevent further lateral movement or data exfiltration. Review user activity logs for anomalous behavior by authenticated accounts, focusing on element-select rule modifications. Check for outbound connections to unknown external IPs that may indicate command-and-control communication. Preserve forensic artifacts before attempting remediation to support incident response investigations.

Background: National Vulnerability Database

The National Vulnerability Database is the U.S. government’s repository of security flaws in software and hardware. It assigns unique identifiers to each issue, allowing organizations to track, prioritize, and remediate risks using standardized references rather than vague descriptions.

Read the full guide: National Vulnerability Database: Meaning, Structure, and Daily Use

What to do and how to stay safe: Craft CMS

• Verify your Craft CMS installation version against the affected ranges listed in the advisory.
• Review access logs for recent unauthorized file writes or suspicious callable arguments in form data.
• Restrict control panel access to trusted IP addresses to limit the attack surface.
• Prepare to update to version 4.18.8 or 5.11.0 as soon as the vendor confirms the fix is available.

Step-by-step guide: Lateral Movement Prevention Checklist for Network Security

General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-112770?

The vulnerability has a CVSS score of 8.7, which is classified as high severity.

Which Craft CMS versions are not affected by this flaw?

Craft CMS 4.18.8 and later, as well as Craft CMS 5.11.0 and later, are not affected.

Does this vulnerability require authentication to exploit?

Yes, the source material states that authenticated control panel users are required to exploit this flaw.