---
id: CVE-2026-109304
title: >-
  Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 contains an arbitrary
  file read vulnerability because the Twig create() class blocklist does not
  cover DOMDocument
summary: >-
  Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 contains an arbitrary
  file read vulnerability because the Twig create() class blocklist does not
  cover DOMDocument. Attackers able to set an entry-type title format, including
  via pr…
severity: medium
cvss: 4.9
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-200
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T17:17:24.610'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109304'
references:
  - url: 'https://github.com/craftcms/cms/security/advisories/GHSA-j5wg-m2pr-35qc'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/craft-cms-4.0.0-before-4.18.7-and-5.0.0-before-5.10.14-arbitrary-file-read-via-twig-create-domdocument
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-12T18:00:08.195Z'
---

## Overview

Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 contains an arbitrary file read vulnerability because the Twig create() class blocklist does not cover DOMDocument. Attackers able to set an entry-type title format, including via project-config/apply, can use create('DOMDocument').loadHTMLFile() with textContent to expose local file contents to non-admin users who can view entries.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.