Remote Code Execution and File Access Vulnerabilities in Craft CMS

CVE-2026-28783

What is CVE-2026-28783?

Craft CMS, a widely used content management system, had a significant security flaw prior to versions 5.9.0-beta.1 and 4.17.0-beta.1. This vulnerability arose from an inadequate blocklist for potentially harmful PHP functions accessible through Twig non-Closure arrow functions. An attacker could exploit this issue if they had 'allowAdminChanges' enabled in production settings, a compromised administrative account, or access to the System Messages utility. The absence of certain PHP functions from the blocklist could enable adversaries to execute various malicious payloads, including remote code execution (RCE), arbitrary file reads, server-side request forgery (SSRF), and server-side template injection (SSTI). Updates in the specified versions address these vulnerabilities.

References