AIKIDO-2026-525278
craftcms/cms is vulnerable to Information Disclosure
55
Medium Risk
This Affects:
craftcms/cmsTL;DR
Craft CMS's column, contains, index, where, filterByValue, and multisort Twig filters pass a caller supplied key straight to ArrayHelper without checking whether the current Twig environment is sandboxed. A dotted key reaching these filters lets a sandboxed template resolve a nested property path on an array or object the sandbox is meant to keep opaque, disclosing a value the caller should not read. The fix adds a preventDottedNameInSandbox() guard that rejects dotted key names in sandbox mode before ArrayHelper resolves them.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and have Craft's Twig sandbox enabled via enableTwigSandbox or render sandboxed object templates that pass a dotted key to one of the affected filters.
Background info
craftcms/cms is vulnerable to Information Disclosure in versions 4.17.0 - 4.18.7 and 5.9.0 - 5.10.14.
How to fix this
Upgrade the craftcms/cms library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.