CVE-2026-28697

Description

Craft is a content management system (CMS). Prior to 4.17.0-beta.1 and 5.9.0-beta.1, an authenticated administrator can achieve Remote Code Execution (RCE) by injecting a Server-Side Template Injection (SSTI) payload into Twig template fields (e.g., Email Templates). By calling the craft.app.fs.write() method, an attacker can write a malicious PHP script to a web-accessible directory and subsequently access it via the browser to execute arbitrary system commands. This vulnerability is fixed in 4.17.0-beta.1 and 5.9.0-beta.1.

PUBLISHED Reserved 2026-03-02 | Published 2026-03-04 | Updated 2026-03-06 | Assigner GitHub_M

Problem types

CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine

Product status

References

github.com/...ms/cms/security/advisories/GHSA-v47q-jxvr-p68x

github.com/craftcms/cms/pull/18216

github.com/craftcms/cms/pull/18219

github.com/...ommit/9dc2a4a3ec8e9cd5e8c0d1129f36371437519197

cve.org (CVE-2026-28697)

nvd.nist.gov (CVE-2026-28697)

Download JSON