Remote Code Execution Vulnerability in Craft CMS by Craft
CVE-2026-28695

7.5HIGH

Key Information:

Vendor

Craftcms

Status
Cms
Vendor
CVE Published:
4 March 2026

What is CVE-2026-28695?

Craft CMS suffers from a Remote Code Execution vulnerability due to an authenticated admin exploit via Server-Side Template Injection. This flaw arises from the use of the create() Twig function, which allows attackers to instantiate arbitrary PHP classes, leveraging the Symfony Process component. The attack method bypasses previous security measures implemented for earlier vulnerabilities, providing an opportunity for unauthorized command execution. This issue has been addressed in versions 5.9.0-beta.1 and 4.17.0-beta.1, urging users to upgrade their installations for enhanced security.

Affected Version(s)

cms >= 5.8.7, < 5.9.0-beta.1 < 5.8.7, 5.9.0-beta.1

cms >= 4.0.0-RC1, < 4.17.0-beta.1 < 4.0.0-RC1, 4.17.0-beta.1

References

https://github.com/craftcms/cms/security/advisories/GHSA-...
x_refsource_CONFIRM
https://github.com/craftcms/cms/commit/e31e50849ad71638e1...
x_refsource_MISC

CVSS V4

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.