psf-craftcms-check(8)

Script: /opt/psf-security-patches/craft/craftcms-check.sh. Tool page: Craft CMS. Source. With the package installed: man psf-craftcms-check.

Craft CMS Twig create() blocklist bypass: read-only checker  (v1)
CVE-2026-112777 (GHSA-w643-x88w-6wcm)

If this software is helpful, consider a donation to our 501c3 nonprofit:
https://privacysafe.foundation

Craft CMS restricts which classes the Twig create() function may instantiate
with a blocklist. The class-name checks are case-sensitive while PHP class
resolution is not, so a differently capitalized class name slips past the
blocklist. The result is remote code execution, or reading secrets such as
the .env file, for someone who can get Twig to render attacker-controlled
template content. CVSS 8.7 (v4.0), 7.2 (v3.1). It is an authenticated flaw:
it needs template-execution rights, so the realistic attackers are a
compromised or malicious control panel account, or any setup that lets
untrusted users supply template code. A GitHub proof of concept has been
reported by one CVE aggregator and is not linked here.

  Affected: Craft CMS 4.x from 4.0.0 before 4.18.8, and 5.x from 5.0.0 before 5.11.0
  Fixed:    4.18.8 and 5.11.0

The same two releases fix several related Twig sandbox and behavior-injection
flaws, so updating covers more than this one issue.

This script is read-only. It reads the Craft version from the installed
vendor/craftcms/cms (and from composer.lock), and from config/general.php it
reports whether allowAdminChanges is off and whether the Twig sandbox is on.

Usage:
  ./craftcms-check.sh [command] [DIR ...]

  check (default)  scan DIR (default /var/www /srv /home /opt) for Craft
                   projects. Exit 0 = nothing affected, 1 = an affected
                   version was found.
  version          print the script version.
Containers: with no directory argument the check also copies the files it reads from running
docker and podman containers (SCAN_CONTAINERS=1, the default; 0 skips them) and judges them like
host installs. The copies are temporary: a path shown as .../docker_NAME_PATH is the PATH inside
the container NAME.

The Security Patches software and this documentation are dedicated to the public domain under CC0 1.0 Universal. Other pages on privacysafe.app/docs are CC BY-SA 4.0 unless the page says otherwise.