Craft CMS versions before 4.18.8 for the 4.x line and before 5.11.0 for the 5.x line contain a blocklist bypass in the Twig create() function. The function performs case‑sensitive class‑name checks while PHP class resolution is case‑insensitive. This mismatch allows an attacker to instantiate a PHP class using a lowercase name that is blocked in the list, enabling operations such as creating a SplFileObject. With template‑execution rights—typically held by Control Panel administrators—the attacker can leverage this flaw to read sensitive files such as .env or to write a PHP file into the webroot, leading to remote code execution. The flaw maps to CWE‑184, a copy‑paste error that causes incorrect program behavior.

The vulnerability impacts Craft CMS installations running version 4.x prior to 4.18.8 or version 5.x prior to 5.11.0. Sites that host the affected CMS build and have users with template‑execution privileges are at risk. The bug resides in the core Twig integration component of the Craft CMS application.

The CVSS score for this issue is 8.7, indicating a high severity level. EPSS data is not available, so the likelihood of exploitation cannot be quantified from the supplied data. The vulnerability is not listed in the CISA KEV catalog, implying no known public exploits at the time of analysis. However, exploitation requires template‑execution rights, a privilege usually granted to administrative users, so the impact scope is limited to sites where such users exist. Once the privilege is obtained, the attack path is straightforward, underscoring the need for immediate patching and strict access controls.