CVE-2026-112770

Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in the Twig group filter, which invokes non-string arrow arguments as callables without the checkArrow guard used by other arrow-accepting filters. Authenticated control panel users can pass an...

EUVD-2026-104576

Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in the Twig group filter, which invokes non-string arrow arguments as callables without the checkArrow guard used by other arrow-accepting filters. Authenticated control panel users can pass an...

CVE-2026-112770

Craft CMS versions 4.x before 4.18.8 and 5.x before 5.11.0 are vulnerable to remote code execution (RCE) via the Twig group filter . The root cause is that the filter invokes non-string arrow arguments as callables without the mandatory checkArrow guard. An authenticated control panel user can ex...