CVE-2026-112770

Craft CMS versions 4.x before 4.18.8 and 5.x before 5.11.0 are vulnerable to remote code execution (RCE) via the Twig group filter . The root cause is that the filter invokes non-string arrow arguments as callables without the mandatory checkArrow guard. An authenticated control panel user can ex...