CVE-2026-28697 - Vulnerability Analysis

Overview

Craft CMS < 4.17.0-beta.1 and < 5.9.0-beta.1 contains a server-side template injection caused by injection of SSTI payloads into Twig template fields, letting authenticated administrators achieve remote code execution by writing malicious PHP scripts, exploit requires authenticated administrator privileges.

Severity & Score

Impact

Authenticated administrators can execute arbitrary system commands remotely, leading to full server compromise.

Mitigation

Update to version 4.17.0-beta.1 or 5.9.0-beta.1 or later.

References

• https://github.com/craftcms/cms/commit/9dc2a4a3ec8e9cd5e8c0d1129f36371437519197
• https://github.com/craftcms/cms/pull/18216
• https://github.com/craftcms/cms/pull/18219
• https://github.com/craftcms/cms/security/advisories/GHSA-v47q-jxvr-p68x

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 5, 2026

🔴 CVE-2026-28697 - Critical (9.1) Craft is a content management system (CMS). Prior to 4.17.0-beta.1 and 5.9.0-beta.1, an authenticated administrator can achieve Remote Code Execution (RCE) by injecting a Server-Side Template Injection (SSTI) payload into Twig template fields (e.g... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28697/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner