CVE-2026-112772 | Craft CMS up to 5.10.x Twig Sandbox Craft::createObject as/on code injection

October 19, 2026 Yanac

A vulnerability classified as problematic was found in Craft CMS up to 5.10.x. Affected is the function Craft::createObject of the component Twig Sandbox. The manipulation of the argument as/on results in code injection.

This vulnerability is known as CVE-2026-112772. It is possible to launch the attack remotely. No exploit is available.

Upgrading the affected component is advised.VulDB Recent EntriesRead More