{"schema":"threatline.record/2","record":{"id":"GHSA-w643-x88w-6wcm","aliases":["GHSA-w643-x88w-6wcm"],"summary":"Twig \"create()\" blocklist case-sensitivity bypass","details":"The blocklist guarding Craft’s Twig `create()` function — introduced in 5.10.6 as the fix for 1369 — tests attacker-controlled class names with **case-sensitive** string prefix/suffix checks, while PHP class resolution is **case-insensitive**.\r\n\r\nPassing the class name in lowercase (`create(\"splfileobject\", …)`) bypasses both checks and instantiates `SplFileObject`, restoring arbitrary local file read and write from any template-execution context. File write escalates to remote code execution by writing a PHP file into the webroot and requesting it over HTTP.\r\n\r\nTwo independent defects combine in `Extension::createFunction()` (`src/web/twig/Extension.php:1543-1574`, 5.10.13.2):\r\n\r\n1. `str_starts_with(ltrim($class, '\\\\'), 'Spl')` (`:1564`) and `str_ends_with(rtrim($class, '\\\\'), 'Iterator')` (`:1568`) are case-sensitive; `Craft::createObject()` resolves `\"splfileobject\"` to `SplFileObject` regardless.\r\n2. When the `Spl` prefix check was added in 5.10.6, `SplFileObject` was simultaneously *removed* from the surviving case-insensitive `is_a()` blocklist (`:1550-1562`), so no case-insensitive check covers it at all.\r\n\r\nThis is a regression of the original 1369 fix: the proper case name is blocked, the lowercase name is not.\r\n\r\n## Impact\r\n\r\nAn attacker with template-execution rights (e.g., a Control Panel administrator in the default configuration) can:\r\n\r\n- Read any file the web user can read, including `.env` → theft of `CRAFT_SECURITY_KEY` and database credentials (Craft’s canonical privilege-escalation chain).\r\n- Write any file the web user can write; demonstrated end-to-end: PHP shell written into the webroot → HTTP-triggered code execution as the web user.\r\n- Defeat the blocklist as a security boundary for any other consumer of `create()`.\r\n\r\nReport ID: 1681","categories":["Unclassified"],"product":"craftcms/cms","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/craftcms/cms/security/advisories/GHSA-w643-x88w-6wcm","source_modified_at":"2026-10-05T17:27:44Z","fetched_at":"2026-10-25T05:59:55.871881Z","package":{"ecosystem":"composer","name":"craftcms/cms"},"range":">= 4.0.0, < 4.18.8"},{"source":"GitHub Advisory Database","source_url":"https://github.com/craftcms/cms/security/advisories/GHSA-w643-x88w-6wcm","source_modified_at":"2026-10-05T17:27:44Z","fetched_at":"2026-10-25T05:59:55.871881Z","package":{"ecosystem":"composer","name":"craftcms/cms"},"range":">= 5.0.0, < 5.11.0"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/craftcms/cms/security/advisories/GHSA-w643-x88w-6wcm","source_modified_at":"2026-10-05T17:27:44Z","fetched_at":"2026-10-25T05:59:55.871881Z","package":{"ecosystem":"composer","name":"craftcms/cms"},"version":"4.18.8"},{"source":"GitHub Advisory Database","source_url":"https://github.com/craftcms/cms/security/advisories/GHSA-w643-x88w-6wcm","source_modified_at":"2026-10-05T17:27:44Z","fetched_at":"2026-10-25T05:59:55.871881Z","package":{"ecosystem":"composer","name":"craftcms/cms"},"version":"5.11.0"}],"cvss":null,"severity":"Low","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-05T17:27:44Z","modified_at":"2026-10-05T17:27:44Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/craftcms/cms/security/advisories/GHSA-w643-x88w-6wcm","fetched_at":"2026-10-25T05:59:55.871881Z","source_modified_at":"2026-10-05T17:27:44Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-05T17:27:44Z","content_hash":"21d5fd5bf87644c71aeab9410d9b66ccd282e3004b2fa961902fefe9999eff06"}}