CVE-2026-28697
Published: 04 March 2026
Summary
CVE-2026-28697 is a critical-severity Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) vulnerability in Craftcms Craft Cms. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 43.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Validates inputs to Twig template fields like Email Templates to block SSTI payloads that enable RCE via craft.app.fs.write().
Requires timely identification, testing, and deployment of patches such as those in Craft 4.17.0-beta.1 and 5.9.0-beta.1 that fix the SSTI vulnerability.
Monitors file system integrity to detect unauthorized writes of malicious PHP scripts to web-accessible directories.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SSTI in Twig templates directly enables T1221 (Template Injection). As a public-facing CMS, facilitates T1190 (Exploit Public-Facing Application). Allows writing executable PHP scripts to web directories, enabling T1100 (Web Shell).
NVD Description
Craft is a content management system (CMS). Prior to 4.17.0-beta.1 and 5.9.0-beta.1, an authenticated administrator can achieve Remote Code Execution (RCE) by injecting a Server-Side Template Injection (SSTI) payload into Twig template fields (e.g., Email Templates). By calling the craft.app.fs.write()…
more
method, an attacker can write a malicious PHP script to a web-accessible directory and subsequently access it via the browser to execute arbitrary system commands. This vulnerability is fixed in 4.17.0-beta.1 and 5.9.0-beta.1.
Deeper analysisAI
CVE-2026-28697 is a critical remote code execution (RCE) vulnerability (CVSS 9.1; AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) affecting Craft, a content management system (CMS). It stems from a Server-Side Template Injection (SSTI) flaw (CWE-1336) in Twig template fields, such as Email Templates, in versions prior to 4.17.0-beta.1 and 5.9.0-beta.1. An authenticated administrator can inject malicious payloads into these fields, exploiting the craft.app.fs.write() method to write arbitrary PHP scripts to web-accessible directories.
The attack requires administrator privileges but can be carried out remotely with low complexity. Once injected, the SSTI payload allows the attacker to persist a malicious PHP file on the server. Accessing this file via a browser triggers execution of arbitrary system commands, potentially leading to full server compromise, data exfiltration, or further lateral movement.
Craft CMS patches this issue in versions 4.17.0-beta.1 and 5.9.0-beta.1. Security practitioners should upgrade immediately and review the GitHub security advisory (GHSA-v47q-jxvr-p68x), commit 9dc2a4a3ec8e9cd5e8c0d1129f36371437519197, and pull requests #18216 and #18219 for implementation details and verification steps.
Details
- CWE(s)