Code Injection in Craft CMS - #VU159607
Published: November 6, 2026
Vulnerability identifier: #VU159607
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an attacker who can author entry type title formats to execute arbitrary server-side code.
The vulnerability exists due to an incomplete class blocklist in Craft CMS's non-sandboxed template renderer when processing attacker-authored title formats. An attacker who can author entry type title formats can use ZipArchive or XMLWriter to write arbitrary content to arbitrary paths, achieving remote code execution when the destination is the web document root.
Affected software
Craft CMS
Remediation
Install security update from vendor's website.
Craft CMS - update to 5.11.4