CVE-2026-28697 Details
Description
Craft is a content management system (CMS). Prior to 4.17.0-beta.1 and 5.9.0-beta.1, an authenticated administrator can achieve Remote Code Execution (RCE) by injecting a Server-Side Template Injection (SSTI) payload into Twig template fields (e.g., Email Templates). By calling the craft.app.fs.write() method, an attacker can write a malicious PHP script to a web-accessible directory and subsequently access it via the browser to execute arbitrary system commands. This vulnerability is fixed in 4.17.0-beta.1 and 5.9.0-beta.1.
A remote code execution vulnerability has been identified in Craft CMS versions 4.0.0-RC1 prior to 4.17.0-beta.1 and 5.0.0-RC1 prior to 5.9.0-beta.1. The issue arises from an authenticated administrator's ability to inject a Server-Side Template Injection (SSTI) payload into Twig template fields, such as email templates. Exploitation involves using the 'craft.app.fs.write()' method to write a malicious PHP script to a web-accessible directory, which can then be accessed through a browser to execute arbitrary system commands.
Users can update to Craft CMS versions 4.17.0-beta.1 or 5.9.0-beta.1, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/craftcms/cms/commit/9dc2a4a3ec8e9cd5e8c0d1129f36371437519197 | [email protected] | Patch |
| https://github.com/craftcms/cms/pull/18216 | [email protected] | Issue TrackingPatch |
| https://github.com/craftcms/cms/pull/18219 | [email protected] | Issue TrackingPatch |
| https://github.com/craftcms/cms/security/advisories/GHSA-v47q-jxvr-p68x | [email protected] | ExploitMitigationPatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1336 | Improper Neutralization of Special Elements Used in a Template Engine | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| craftcms craft cms | > 4.0.0, < 4.17.0 > 5.0.0, < 5.9.0 4.0.0 - 4.0.0 rc1 4.0.0 rc2 4.0.0 rc3 5.0.0 - 5.0.0 rc1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 5, 2026 | Initial Analysis | [email protected] |
| Mar 4, 2026 | New CVE Received | [email protected] |