PT-2026-22997 · Craft Cms · Craft Cms

Rajchowdhury240 + 1 · Published 2026-03-03 · Updated 2026-03-05 · CVE-2026-28784

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Craft versions prior to 5.8.22 Craft versions prior to 4.16.18

Description Craft, a content management system (CMS), is susceptible to Remote Code Execution (RCE) through a Server-Side Template Injection (SSTI) issue. A malicious payload can be crafted using the Twig map filter within text fields that accept Twig input. This is possible in the Settings section of the Craft control panel or through the System Messages utility. To successfully exploit this, an attacker must have administrator access to the Craft Control Panel with the allowAdminChanges setting enabled, or a non-administrator account with allowAdminChanges disabled but access to the System Messages utility. The allowAdminChanges setting controls whether non-administrator users can modify settings within the Craft control panel.

Recommendations Craft versions prior to 5.8.22 should be updated to version 5.8.22. Craft versions prior to 4.16.18 should be updated to version 4.16.18.

Exploit

Fix

RCE

Weakness Enumeration

CWE-1336

Related Identifiers

CVE-2026-28784

GHSA-QC86-Q28F-GGWW

Affected Products

Craft Cms

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28784.json · Exploit
• https://github.com/craftcms/cms/security/advisories/GHSA-qc86-q28f-ggww · Vendor Advisory
• https://github.com/craftcms/cms/pull/18208 · Patch
• https://osv.dev/vulnerability/CVE-2026-28784 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28784 · Security Note
• https://osv.dev/vulnerability/GHSA-qc86-q28f-ggww · Vendor Advisory
• https://github.com/craftcms/cms · Note
• https://twitter.com/CVEnew/status/2029272831695995150 · Twitter Post
• https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production · Note
• https://t.me/cveNotify/154297 · Telegram Post
• https://t.me/CVEtracker/46323 · Telegram Post