CVE-2026-112771

Craft CMS versions 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 are vulnerable to a Twig sandbox allowlist bypass . The issue arises because specific filters—including column , contains , filterByValue , index , where , and multisort —resolve caller-supplied keys using ArrayHelper::getValue() with...