CVE-2026-28784 json
Craft is affected by potential authenticated Remote Code Execution via Twig SSTI
published 2026-03-03 8 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-9451 , GHSA-qc86-q28f-ggww
- cvss
- 7.2
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 48%
- public exploits
- 0
- none known
Summary
Craft is a content management system (CMS). Prior to 5.8.22 and 4.16.18, it is possible to craft a malicious payload using the Twig map filter in text fields that accept Twig input under Settings in the Craft control panel or using the System Messages utility, which could lead to a RCE. For this to work, you must have administrator access to the Craft Control Panel, and allowAdminChanges must be enabled for this to work, which is against our recommendations for any non-dev environment. Alternatively, you can have a non-administrator account with allowAdminChanges disabled, but you have access to the System Messages utility. Users should update to the patched versions (5.8.22 and 4.16.18) to mitigate the issue.
Patch / fix
- packagist craftcms/cms 4.17.0-beta.1, 5.9.0-beta.1
- craftcms craft_cms 4.17.0-beta.1, 5.9.0-beta.1
- github.com/craftcms/cms#18208 pull request
- github.com/craftcms/cms/security/advisories/GHSA-qc86-q28f-ggww advisory
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 8 mo ago
Exploit prediction
0.59% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 4.0 | 8.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | craftcms/cms | >=5.0.0-RC1, <5.9.0-beta.1 >=4.0.0-RC1, <4.17.0-beta.1 |
5.9.0-beta.1 4.17.0-beta.1 |
Affected products
- craftcms cms
Classification
- Weakness
-
- CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine
References
-
github.com
/craftcms/cms/pull/18208
web, issue-tracking, patch
-
github.com
/craftcms/cms/security/advisories/GHSA-qc86-q28f-ggww
web, patch, vendor-advisory
-
craftcms.com
/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production
web, technical-description
-
nvd.nist.gov
/vuln/detail/CVE-2026-28784
advisory
-
github.com
/craftcms/cms
package
Sources
- CVE List CVE-2026-28784
- GitHub Advisory GHSA-qc86-q28f-ggww
- NVD CVE-2026-28784
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.