Listen to this Post
The `create()` Twig function, introduced in Craft CMS 5.9.0, allows instantiation of arbitrary PHP classes directly from template code. To prevent abuse, the function implements a blocklist containing five disallowed classes. However, `SplFileObject` – a PHP class designed for file system interaction – is not present on this blocklist.
This oversight enables an authenticated administrator to inject a malicious payload into a non-sandboxed Twig template context, such as an entry type’s format or URI format. By setting the format to create('SplFileObject', ['/path/to/target/file']), the `SplFileObject` constructor reads the specified file from the server’s filesystem. The file’s contents are then rendered as part of the entry and become visible to any user with permission to view entries in that section.
The vulnerability is limited to non-sandboxed contexts. The Twig sandbox, which is active in system email templates and other sensitive areas, correctly blocks the `create()` function. Therefore, this finding applies exclusively to admin-configured contexts that require allowAdminChanges=true.
Exploitation requires several prerequisites: administrative access to the Craft control panel, the `allowAdminChanges` setting enabled (which is the default in development and staging environments but strongly discouraged in production), and the ability to edit entry type settings. Any user who subsequently creates an entry in the affected section will trigger the file read operation.
The impact is significant in production environments. An attacker who has compromised an admin account, or a malicious insider, can read arbitrary files including `.env` files that contain the CRAFT_SECURITY_KEY, database credentials, and third-party API keys. Exposure of the `CRAFT_SECURITY_KEY` enables an attacker to forge session tokens and escalate to full admin account takeover.
The vulnerability is rated low severity by Craft’s own guidelines because it requires `allowAdminChanges=true` and administrative privileges. The issue has been patched in Craft CMS versions 4.18.2 and 5.10.6.
DailyCVE Form:
Platform: Craft CMS
Version: ≥5.0.0-RC1, <5.10.6; ≥4.0.0-RC1, <4.18.2
Vulnerability: Incomplete blocklist allows SplFileObject
Severity: Low
date: 2026-08-06
Prediction: Already patched in 4.18.2/5.10.6
What Undercode Say:
Check Craft CMS version composer show craftcms/cms | grep versions Verify allowAdminChanges setting in config/general.php grep -r "allowAdminChanges" config/
{ Malicious format payload }
{{ create('SplFileObject', ['/path/to/.env']) }}
{ Alternative payload for /etc/passwd }
{{ create('SplFileObject', ['/etc/passwd']) }}
// Craft's blocklist (incomplete) $blocklist = [ 'craft\elements\Entry', 'craft\elements\Asset', // ... 3 more entries // SplFileObject is NOT blocked ];
Exploit:
An admin navigates to Settings → Sections →
→ Entry Types → [Entry Type] → Format, and injects:
[bash]
{{ create('SplFileObject', ['/path/to/.env']) }}
When any user creates a new entry in that section, the `.env` file contents are rendered as the entry , exposing secrets. The file read is triggered server-side and the output is displayed in the entry list and detail views.
Protection:
- Upgrade to Craft CMS 4.18.2 or 5.10.6 immediately
- Set `allowAdminChanges = false` in production environments
- Restrict administrative access to trusted users only
- Monitor entry type formats for suspicious `create()` function calls
- Implement file system permissions to restrict read access to sensitive files
Impact:
- Confidentiality: Exposure of `.env` files containing
CRAFT_SECURITY_KEY, database passwords, and API keys - Session Hijacking: `CRAFT_SECURITY_KEY` enables forging session tokens and full admin account takeover
- Data Breach: Database credentials allow direct database access, leading to data exfiltration or tampering
- Lateral Movement: API keys may provide access to third-party services (e.g., AWS, Stripe, Mailchimp)
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
