Is CVE-2026-112772 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-112772?

CVE-2026-112772 has a CVSS v3 severity of HIGH (8.8).

Back

CVE-2026-112772

Description

Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox via Asset::getMimeType transforms. Attackers can supply 'as' or 'on' keys passed unfiltered to Craft::createObject, attaching malicious behaviors or event handlers that execute code as the web user.