---
id: CVE-2026-109304
title: >-
  Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 contains an arbitrary
  file read vulnerability because the Twig create() class blocklist does not
  cover DOMDocument
summary: >-
  Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 contains an arbitrary
  file read vulnerability because the Twig create() class blocklist does not
  cover DOMDocument. Attackers able to set an entry-type title format, including
  via pr…
severity: medium
cvss: 4.9
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-200
vendor: craftcms
product: cms
affected:
  - cms >= 4.0.0 < 4.18.7
  - cms >= 5.0.0 < 5.10.14
published: '2026-10-12'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T17:25:57.940'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109304'
references:
  - url: 'https://github.com/craftcms/cms/security/advisories/GHSA-j5wg-m2pr-35qc'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/craft-cms-4.0.0-before-4.18.7-and-5.0.0-before-5.10.14-arbitrary-file-read-via-twig-create-domdocument
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00314
epssPercentile: 0.24185
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-13T15:49:04.368377Z'
ingestedAt: '2026-10-12T18:00:08.195Z'
---

## Overview

Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 contains an arbitrary file read vulnerability because the Twig create() class blocklist does not cover DOMDocument. Attackers able to set an entry-type title format, including via project-config/apply, can use create('DOMDocument').loadHTMLFile() with textContent to expose local file contents to non-admin users who can view entries.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.