PT-2026-22949 · Pixel & Tonic · Craft

Mhe4Am · Published 2026-03-03 · Updated 2026-03-05 · CVE-2026-28697

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Craft CMS versions prior to 4.17.0-beta.1 and 5.9.0-beta.1

Description Craft is a content management system (CMS). An authenticated administrator can achieve Remote Code Execution (RCE) by injecting a Server-Side Template Injection (SSTI) payload into Twig template fields, such as Email Templates. By calling the craft.app.fs.write() method, an attacker can write a malicious PHP script to a web-accessible directory and subsequently access it via a browser to execute arbitrary system commands. The vulnerability also allows for the disclosure of sensitive information, including database credentials and the security key, through access to craft.app properties.

Recommendations Update Craft CMS to version 4.17.0-beta.1 or later. Update Craft CMS to version 5.9.0-beta.1 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-1336

Related Identifiers

CVE-2026-28697

GHSA-V47Q-JXVR-P68X

Affected Products

Craft

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28697.json · Exploit
• https://github.com/craftcms/cms/commit/9dc2a4a3ec8e9cd5e8c0d1129f36371437519197 · Patch
• https://github.com/craftcms/cms/security/advisories/GHSA-v47q-jxvr-p68x · Vendor Advisory
• https://github.com/craftcms/cms/pull/18216 · Patch
• https://github.com/craftcms/cms/pull/18219 · Patch
• https://osv.dev/vulnerability/GHSA-v47q-jxvr-p68x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28697 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28697 · Vendor Advisory
• https://github.com/craftcms/cms · Note
• https://t.me/cveNotify/154296 · Telegram Post
• https://twitter.com/TheHackerWire/status/2029527374627500248 · Twitter Post
• https://twitter.com/pulsepatchio/status/2029570652835918082 · Twitter Post
• https://twitter.com/CVEnew/status/2029272835470880856 · Twitter Post