Craft CMS versions prior to 4.18.8 and 5.11.0 suffer a Twig sandbox allowlist bypass that lets authenticated Control Panel users supply dot‑path keys to array filters. These filters call ArrayHelper::getValue() without consulting the sandbox policy, enabling traversal of the craft global namespace to read the securityKey, database credentials, and authentication tokens. The vulnerability is an information‑exposure flaw allowing an attacker with legitimate user credentials to disclose highly sensitive configuration values. Based on the description, it is inferred that a privileged user can simply add a malicious dot‑path to a template to trigger the bypass.

The affected product is Craft CMS, produced by Craft CMS. The issue applies to all releases prior to 4.18.8 of the 4.x line and prior to 5.11.0 of the 5.x line. No additional version modifiers are listed, so any installation running a version earlier than these thresholds is vulnerable.

The CVSS score is 7.1, indicating a moderate to high severity for information disclosure. EPSS data is not available, so the current exploitation likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is that an authenticated Control Panel user can supply arbitrary dot‑path keys; therefore exploitation requires valid credentials but does not require network traversal or remote code execution. Once the bypass is triggered, the attacker can read credentials that are otherwise protected by the CMS's configuration files.