Craft CMS 4.x and 5.x versions prior to 4.18.7 and 5.10.14 contain a flaw in the Twig create() blocklist: DOMDocument is not prohibited. An attacker who can configure an entry‑type title format, for instance through project‑config/apply, can invoke create('DOMDocument').loadHTMLFile() and then read the file content via textContent. This allows a non‑administrator who is authorized to view entries to retrieve any local file that the web process can access, exposing sensitive configuration, code, or system data. The weakness is identified as an Information Disclosure (CWE‑200).

The vulnerability applies to Craft CMS versions 4.0.0 up to 4.18.6 inclusive and 5.0.0 up to 5.10.13 inclusive. The affected product is Craft CMS from the vendor CraftCMS.

The CVSS score of 6.9 indicates a moderate severity. The threat relies on attackers being able to manipulate the entry‑type title format that the application allows. By using Twig's create('DOMDocument').loadHTMLFile() with textContent, a non‑administrator user who has permission to view entries can read arbitrary files that the web process can access. Because this exploit is achievable through the public‑facing interface used to define entry formats, the likelihood of exploitation in a reachable environment is non‑negligible. The vulnerability is listed as Information Disclosure (CWE‑200) and is not currently in the CISA KEV catalog.