CVE-2026-28695 Details
Description
Craft is a content management system (CMS). There is an authenticated admin RCE in Craft CMS 5.8.21 via Server-Side Template Injection using the create() Twig function combined with a Symfony Process gadget chain. The create() Twig function exposes Craft::createObject(), which allows instantiation of arbitrary PHP classes with constructor arguments. Combined with the bundled symfony/process dependency, this enables RCE. This bypasses the fix implemented for CVE-2025-57811 (patched in 5.8.7). This vulnerability is fixed in 5.9.0-beta.1 and 4.17.0-beta.1.
A vulnerability allowing authenticated remote code execution has been identified in Craft CMS versions 5.8.7 prior to 5.9.0-beta.1 and 4.0.0-RC1 prior to 4.17.0-beta.1. This issue arises from server-side template injection via the 'create()' Twig function, which can be exploited using a Symfony Process gadget chain. The 'create()' function allows the instantiation of arbitrary PHP classes, which, when combined with the symfony/process dependency, enables remote code execution. This vulnerability bypasses a previous fix for CVE-2025-57811.
Users can update to Craft CMS versions 5.9.0-beta.1 or 4.17.0-beta.1, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/craftcms/cms/commit/e31e50849ad71638e11ea55fbd1ed90ae8f8f6e0 | [email protected] | Patch |
| https://github.com/craftcms/cms/security/advisories/GHSA-94rc-cqvm-m4pw | [email protected] | ExploitMitigationPatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1336 | Improper Neutralization of Special Elements Used in a Template Engine | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| craftcms craft cms | > 4.0.0, < 4.17.0 > 5.0.0, < 5.9.0 4.0.0 - 4.0.0 rc1 4.0.0 rc2 4.0.0 rc3 5.0.0 - 5.0.0 rc1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 5, 2026 | Initial Analysis | [email protected] |
| Mar 4, 2026 | New CVE Received | [email protected] |