CVE-2026-28695
Craftcms Craft Cms 4.0.0 – 4.17.0
Raw vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-28695 is a high-severity Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) vulnerability in Craftcms Craft Cms. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Template Injection (T1221); ranked at the 43th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Craft CMS, a popular content management system, is affected by CVE-2026-28695, an authenticated remote code execution (RCE) vulnerability with a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The issue stems from server-side template injection (SSTI) in version 5.8.21, where the create() Twig function exposes Craft::createObject(). This allows instantiation of arbitrary PHP classes with constructor arguments, which, when combined with the bundled symfony/process dependency, enables a gadget chain for RCE. The vulnerability is linked to CWE-1336 (Incorrect Handling of Syntactic Elements) and bypasses the mitigation for the related CVE-2025-57811, which was addressed in Craft CMS 5.8.7.
An attacker with authenticated administrator privileges can exploit this vulnerability over the network with low complexity and no user interaction required. By crafting malicious Twig templates that leverage the create() function and symfony/process components, the attacker can execute arbitrary code on the server, potentially leading to full compromise including high confidentiality, integrity, and availability impacts.
The Craft CMS security advisory (GHSA-94rc-cqvm-m4pw) and associated commit (e31e50849ad71638e11ea55fbd1ed90ae8f8f6e0) detail the fix, which is available in versions 5.9.0-beta.1 and 4.17.0-beta.1. Security practitioners should urge users to update to these patched releases immediately, as the vulnerability circumvents prior protections.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9421
Vulnerability Data
Craft is a content management system (CMS). There is an authenticated admin RCE in Craft CMS 5.8.21 via Server-Side Template Injection using the create() Twig function combined with a Symfony Process gadget chain. The create() Twig function exposes Craft::createObject(), which…
more
allows instantiation of arbitrary PHP classes with constructor arguments. Combined with the bundled symfony/process dependency, this enables RCE. This bypasses the fix implemented for CVE-2025-57811 (patched in 5.8.7). This vulnerability is fixed in 5.9.0-beta.1 and 4.17.0-beta.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.3.2V1.3.7V1.3.10
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and static analysis can discover missing neutralization of template directives.
Input validation rejects or sanitizes untrusted data before it reaches the template engine, stopping injection of special syntax.
Security engineering principles require use of safe templating APIs and proper escaping of external input.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require proper input neutralization in template engines to prevent injection.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect template-injection flaws but does not itself implement neutralization controls.
Secure development life cycle mandates input validation and sanitization that directly prevents template-injection weaknesses.
Application security requirements explicitly call for neutralizing special elements in template engines.
Secure architecture principles reduce the likelihood of unsafe template processing but do not prescribe specific neutralization techniques.
Secure coding standards require proper escaping or sandboxing of template directives, directly mitigating CWE-1336.