high8.8
CVE-2026-112772
Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox via …
Impact
Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox via Asset::getMimeType transforms. Attackers can supply 'as' or 'on' keys passed unfiltered to Craft::createObject, attaching malicious behaviors or event handlers that execute code as the web user.
Affected products
| Product | Affected versions |
|---|---|
| Craft CMS From 5.0.0 | before 5.11.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.