CVE-2026-112772 — Craft CMS 5.0.0 before 5.11.0 RCE via Asset::getMimeType Transform Injection
Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox via Asset::getMimeType…
Published: 2026-10-19 · CVSS: 8.7 · CVSS 4.0
Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox via Asset::getMimeType transforms. Attackers can supply 'as' or 'on' keys passed unfiltered to Craft::createObject, attaching malicious behaviors or event handlers that execute code as the web user.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7