What’s Vulnerable › Vulnerabilities

CVE-2026-28784: Craft is affected by potential authenticated Remote Code Execution via Twig SSTI

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-04 · updated 2026-06-17
• Weakness: CWE-1336

Description

Craft is a content management system (CMS). Prior to 5.8.22 and 4.16.18, it is possible to craft a malicious payload using the Twig map filter in text fields that accept Twig input under Settings in the Craft control panel or using the System Messages utility, which could lead to a RCE. For this to work, you must have administrator access to the Craft Control Panel, and allowAdminChanges must be enabled for this to work, which is against our recommendations for any non-dev environment. Alternatively, you can have a non-administrator account with allowAdminChanges disabled, but you have access to the System Messages utility. Users should update to the patched versions (5.8.22 and 4.16.18) to mitigate the issue.

Affected products

• craftcms cms: from 4.0.0 (excl.) before 4.17.0; from 5.0.0 (excl.) before 5.9.0; 4.0.0, 4.0.0-rc1, 4.0.0-rc2, 4.0.0-rc3, 5.0.0, 5.0.0-rc1 — fixed in 4.17.0, 5.9.0

How to fix

Upgrade to a fixed version: craftcms cms 4.17.0, 5.9.0. Check the vendor advisory for mitigations.

References

• https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production
• https://github.com/craftcms/cms/pull/18208
• https://github.com/craftcms/cms/security/advisories/GHSA-qc86-q28f-ggww

Get alerted when CVE-2026-28784 or the next vulnerability affects your stack