PT-2026-22947 · Craft Cms+1 · Craft Cms+1

Andreisss · Published 2026-03-03 · Updated 2026-03-04 · CVE-2026-28695

Positive Technologies (AI Summary)

CVSS v4.0

7.5

High

Base vector

AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.8.21 Craft CMS versions prior to 4.17.0-beta.1 Craft CMS versions prior to 5.9.0-beta.1

Description Craft CMS contains an authenticated Remote Code Execution (RCE) issue. This occurs through Server-Side Template Injection utilizing the create() Twig function in conjunction with a Symfony Process gadget chain. The create() Twig function exposes Craft::createObject(), which allows the instantiation of arbitrary PHP classes with constructor arguments. When combined with the symfony/process dependency, this enables RCE. The issue bypasses a previous fix for CVE-2025-57811. The vulnerability is triggered through the Title Format field in the admin panel (Settings → Entry Types). A proof-of-concept payload involves using the create() function to instantiate a SymfonyComponentProcessProcess object and executing a command via p.mustRun.getOutput(). Successful exploitation allows for full server compromise, as the code executes with the web server user's privileges. The root cause is the ability to instantiate any class, including SymfonyComponentProcessProcess, which then executes shell commands.

Recommendations Craft CMS versions prior to 4.17.0-beta.1 should be updated to version 4.17.0-beta.1 or later. Craft CMS versions prior to 5.9.0-beta.1 should be updated to version 5.9.0-beta.1 or later. As a temporary workaround, consider blocking dangerous classes in createObject() when called from Twig. As a temporary workaround, consider removing or restricting the create() Twig function. As a temporary workaround, consider validating class names against an allowlist.

Exploit

Fix

RCE

Path traversal

Code Injection

Weakness Enumeration

CWE-22

CWE-94

CWE-1336

Related Identifiers

CVE-2026-28695

GHSA-94RC-CQVM-M4PW

Affected Products

Craft Cms

Symfony/Process

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28695.json · Exploit
• https://github.com/craftcms/cms/commit/e31e50849ad71638e11ea55fbd1ed90ae8f8f6e0 · Patch
• https://github.com/craftcms/cms/security/advisories/GHSA-94rc-cqvm-m4pw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-28695 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28695 · Security Note
• https://osv.dev/vulnerability/GHSA-94rc-cqvm-m4pw · Vendor Advisory
• https://github.com/craftcms/cms · Note
• https://twitter.com/CVEnew/status/2029272838234952070 · Twitter Post