CVE-2026-109304

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-109304

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109304.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-109304

Aliases

GHSA-j5wg-m2pr-35qc

Published

2026-10-12T16:05:00Z

Modified

2026-10-13T02:46:38Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 Arbitrary File Read via Twig create() DOMDocument

Details

Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 contains an arbitrary file read vulnerability because the Twig create() class blocklist does not cover DOMDocument. Attackers able to set an entry-type title format, including via project-config/apply, can use create('DOMDocument').loadHTMLFile() with textContent to expose local file contents to non-admin users who can view entries.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-200"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109304.json"
}

References

Affected packages

Git / github.com/craftcms/cms

Affected ranges

Type

GIT

Repo

https://github.com/craftcms/cms

Events

Introduced

982efcd14d7e93a1a54f0905b61f242de6b53d8a

Fixed

565b88afb88df790c5465bcbb0a0b8aef2903dd2

Introduced

f6a8fb685d44e387435825e3a96809eeda4973a6

Fixed

6804f92fbdd93c3a3fb40f15bcd76a406e97634d

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "4.0.0"
        },
        {
            "fixed":  "4.18.7"
        },
        {
            "introduced":  "5.0.0"
        },
        {
            "fixed":  "5.10.14"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109304.json"