Key points
- CVE-2026-112770 carries a CVSS score of 8.7, rated as high severity.
- The flaw exists in the Twig group filter within Craft CMS 4.x and 5.x.
- Versions 4.18.8 and 5.11.0 address the remote code execution vulnerability.
Craft CMS versions 4.x before 4.18.8 and 5.x before 5.11.0 contain a remote code execution vulnerability. The flaw resides in the Twig group filter, which processes non-string arrow arguments as callables. This occurs without the standard checkArrow guard that protects other arrow-accepting filters in the system.
In plain English
The vulnerability allows authenticated control panel users to execute arbitrary code on the server. Attackers can pass an array-callable, such as FileHelper::writeToFile, through element-select condition rules. This action enables them to write a webshell directly to the webroot. Once the webshell is in place, the attacker can execute code with the privileges of the web user.
The background
The National Vulnerability Database records this issue as CVE-2026-112770. It is classified under CWE-94 for improper control of generation of code. The CVSS score is 8.7, which places the severity in the high category. The description notes that the specific lack of the checkArrow guard in the group filter distinguishes it from other filters that handle similar inputs safely.
What changes now
Teams using Craft CMS must verify their current version immediately. If the installation is below version 4.18.8 or 5.11.0, it is vulnerable to this remote code execution flaw. According to the source material, versions 4.18.8 and 5.11.0 are the fixed releases. Organizations should update to these versions to resolve the issue.
Who needs to act first
Security teams usually prioritize systems exposed to the internet or accessible by many users. Check whether any Craft CMS instances allow regular staff to access the control panel. If so, restrict those accounts immediately to reduce the attack surface. Back up all site data and configurations before making any changes. Test any potential mitigation steps in a staging environment first. Monitor logs for unusual file creation or execution attempts.
What to do and how to stay safe: Craft CMS
- Audit all Craft CMS installations to identify versions below 4.18.8 and 5.11.0.
- Restrict access to the control panel for users who do not need administrative privileges.
- Monitor web server logs for signs of webshell creation or unusual file writes.
- Update to Craft CMS 4.18.8 or 5.11.0 once the vendor provides the update.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-112770?
The CVSS score is 8.7, which is rated as high severity.
Which versions of Craft CMS are affected?
Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 are affected.
Is there a patch available for this vulnerability?
Versions 4.18.8 and 5.11.0 address the vulnerability.
