PT-2026-22996 · Craft · Craft

Mhe4Am · Published 2026-03-03 · Updated 2026-03-04 · CVE-2026-28783

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Craft versions prior to 5.9.0 Craft versions prior to 4.17.0

Description Craft is a content management system (CMS). The system uses a blocklist to prevent potentially dangerous PHP functions from being called via Twig non-Closure arrow functions. Several PHP functions were not included in this blocklist, potentially allowing malicious actors with the required permissions to execute payloads, including remote code execution (RCE), arbitrary file reads, server-side request forgery (SSRF), and server-side template injection (SSTI). To successfully exploit this, an attacker needs to have allowAdminChanges enabled on production, a compromised admin account, or an account with access to the System Messages utility. Twig has deprecated the behavior that allowed this, and it will eventually be removed from Twig altogether.

Recommendations Versions prior to 5.9.0 should be updated to version 5.9.0. Versions prior to 4.17.0 should be updated to version 4.17.0 and the enableTwigSandbox config setting should be enabled.

Exploit

Fix

RCE

Incomplete List of Disallowed Inputs

Code Injection

Weakness Enumeration

CWE-1336

CWE-184

CWE-94

Related Identifiers

CVE-2026-28783

GHSA-5FVC-7894-GHP4

Affected Products

Craft

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28783.json · Exploit
• https://github.com/craftcms/cms/security/advisories/GHSA-5fvc-7894-ghp4 · Patch
• https://github.com/craftcms/cms/pull/18208 · Patch
• https://osv.dev/vulnerability/GHSA-5fvc-7894-ghp4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28783 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28783 · Vendor Advisory
• https://github.com/twigphp/Twig/blob/946ddeafa3c9f4ce279d1f34051af041db0e16f2/src/Extension/CoreExtension.php#L2096 · Note
• https://github.com/craftcms/cms · Note
• https://twitter.com/CVEnew/status/2029272832723624065 · Twitter Post
• https://t.me/CVEtracker/46322 · Telegram Post