CVE-2026-28697 - Vulnerability Analysis

Overview

Craft CMS < 4.17.0-beta.1 and < 5.9.0-beta.1 contains a server-side template injection caused by injection of SSTI payloads into Twig template fields, letting authenticated administrators achieve remote code execution by writing malicious PHP scripts, exploit requires authenticated administrator privileges.

Severity & Score

Impact

Authenticated administrators can execute arbitrary system commands remotely, leading to full server compromise.

Mitigation

Update to version 4.17.0-beta.1 or 5.9.0-beta.1 or later.

References

• https://github.com/craftcms/cms/commit/9dc2a4a3ec8e9cd5e8c0d1129f36371437519197
• https://github.com/craftcms/cms/pull/18216
• https://github.com/craftcms/cms/pull/18219
• https://github.com/craftcms/cms/security/advisories/GHSA-v47q-jxvr-p68x

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner