Summary
Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts
The create() Twig function (introduced in 5.9.0) allows instantiation of arbitrary PHP classes from template code, restricted only by a 5-entry blocklist. SplFileObject is not in the blocklist, enabling arbitrary file read, including .env (security key, DB credentials) and the passwd file from non-sandboxed Twig template contexts, such as entry type title formats and URI formats.
The sandbox correctly blocks create() in system email templates, so this finding applies only to admin-configured, non-sandboxed contexts that require allowAdminChanges=true.
Prerequisites
- Admin access to the Craft control panel
allowAdminChangesmust betrue(default in dev/staging, recommendedfalsein production)- Admin must be able to edit entry type settings (title format, URI format)
- Any user who subsequently creates an entry in the affected section triggers the file read
Limitations
- Requires admin-level access: not exploitable by low-privilege users
allowAdminChangesmust betrue: production best practices recommendfalse, which prevents entry type configuration changes- Per Craft’s own severity guidelines, findings requiring
allowAdminChanges=trueare rated low - The
create()function is blocked by the Twig sandbox, so this cannot be exploited via system email templates or any other sandboxed context
Impact
An admin user (or an attacker who has compromised an admin account) can read arbitrary files from the server filesystem by setting a malicious entry type title format using create('SplFileObject', ['/path/to/file']). In production environments, this exposes .env files containing the CRAFT_SECURITY_KEY, database credentials, API keys, and other secrets. The file contents are rendered as entry titles visible to any user with permission to view entries in the affected section.
The impact is limited by the requirement for admin access and allowAdminChanges=true.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
craftcms/cms to 5.10.6 or later; craftcms/cms to 4.18.2 or later
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is GHSA-957R-QF9P-67XW? GHSA-957R-QF9P-67XW is a medium-severity security vulnerability in craftcms/cms (composer), affecting versions >= 5.0.0-RC1, < 5.10.6. It is fixed in 5.10.6, 4.18.2.
- Which versions of craftcms/cms are affected by GHSA-957R-QF9P-67XW? craftcms/cms (composer) versions >= 5.0.0-RC1, < 5.10.6 is affected.
- Is there a fix for GHSA-957R-QF9P-67XW? Yes. GHSA-957R-QF9P-67XW is fixed in 5.10.6, 4.18.2. Upgrade to this version or later.
- Is GHSA-957R-QF9P-67XW exploitable, and should I be worried? Whether GHSA-957R-QF9P-67XW is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-957R-QF9P-67XW is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix GHSA-957R-QF9P-67XW?
- Upgrade
craftcms/cmsto 5.10.6 or later - Upgrade
craftcms/cmsto 4.18.2 or later
- Upgrade