The vulnerability is an arbitrary file read that allows an authenticated administrator to read any file on the server through a blocked Twig create() function that does not block SplFileObject. This is an example of CWE‑184, where the application does not properly constrain user input that can result in unauthorized access to system resources. An attacker can then configure a malicious entry type title or URI format that instantiates SplFileObject, causing the system to render the contents of files such as .env with database credentials or security keys as entry titles. This results in disclosure of highly confidential information and could facilitate further attacks.

Craft CMS versions 5.0.0‑RC1 through 5.10.5 inclusive, and 4.0.0‑RC1 through 4.18.1 inclusive are susceptible to this flaw. The issue is tied to the Twig template engine and the create() function used by the CMS.

The CVSS score of 8.7 indicates a high severity with a high impact on confidentiality. This CVE is categorized as CWE-184, reflecting a failure to restrict the operations performed on the file system. The exploit requires attacker to have administrator privileges with allowAdminChanges set to true; no external network access is required. EPSS data is unavailable, and the vulnerability has not been listed in CISA’s KEV catalog, but the lack of a blacklist for SplFileObject makes the flaw straightforward to leverage once an admin account is compromised.