CVE-2026-112772
HIGH
NVD
CVSS Score
8.8
Severity
HIGH
Published
Oct 19, 2026
Vendor
unknown
Description
Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox via Asset::getMimeType transforms. Attackers can supply 'as' or 'on' keys passed unfiltered to Craft::createObject, attaching malicious behaviors or event handlers that execute code as the web user.