CVE-2026-28695: Craftcms Craft CMS RCE Vulnerability

CVE-2026-28695 Overview

CVE-2026-28695 is a Server-Side Template Injection (SSTI) vulnerability affecting Craft CMS, a popular content management system. This vulnerability allows authenticated administrators to achieve Remote Code Execution (RCE) by exploiting the create() Twig function in combination with a Symfony Process gadget chain. The flaw represents a bypass of the security fix implemented for CVE-2025-57811 (patched in version 5.8.7).

The create() Twig function exposes Craft::createObject(), which permits instantiation of arbitrary PHP classes with constructor arguments. When combined with the bundled symfony/process dependency, attackers with admin-level access can execute arbitrary code on the underlying server.

Critical Impact

Authenticated administrators can achieve full Remote Code Execution on affected Craft CMS installations, potentially leading to complete server compromise, data exfiltration, and lateral movement within the network.

Affected Products

• Craft CMS version 5.8.21 and earlier versions in the 5.x branch (prior to 5.9.0-beta.1)
• Craft CMS 4.x versions (prior to 4.17.0-beta.1)
• Any Craft CMS installation using the bundled symfony/process dependency

Discovery Timeline

• March 4, 2026 - CVE-2026-28695 published to NVD
• March 5, 2026 - Last updated in NVD database

Technical Details for CVE-2026-28695

Vulnerability Analysis

This vulnerability is classified under CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine), representing a Server-Side Template Injection attack vector. The attack requires network access and high privileges (administrative authentication), but once those conditions are met, exploitation can lead to complete compromise of confidentiality, integrity, and availability on the vulnerable system.

The core issue lies in how Craft CMS handles object instantiation through its Twig template engine. The create() function was designed to provide flexibility for template authors but inadvertently creates a pathway for code execution when combined with vulnerable PHP class instantiation patterns.

Root Cause

The root cause of this vulnerability stems from the exposure of Craft::createObject() through the create() Twig function. This method allows arbitrary PHP class instantiation with user-controlled constructor arguments. While the previous fix for CVE-2025-57811 attempted to address this issue, the mitigation was incomplete, allowing attackers to discover an alternative exploitation path using the Symfony Process gadget chain.

The bundled symfony/process dependency provides the necessary components for attackers to chain together class instantiations that ultimately result in command execution. This represents a classic gadget chain attack pattern commonly seen in PHP deserialization and object injection vulnerabilities.

Attack Vector

The attack requires authenticated administrative access to the Craft CMS control panel. An attacker with these privileges can craft malicious Twig template code that:

1. Utilizes the create() Twig function to instantiate arbitrary PHP classes
2. Leverages constructor arguments to pass attacker-controlled data
3. Chains the Symfony Process class instantiation to achieve command execution
4. Executes arbitrary system commands on the underlying server

The vulnerability exploits the trust boundary between template rendering and core PHP functionality, allowing template-level code to break out of the sandboxed template environment and interact directly with system-level operations.

Detection Methods for CVE-2026-28695

Indicators of Compromise

• Unusual Twig template modifications containing create() function calls with suspicious class names
• Web server logs showing administrative panel access followed by unexpected system process spawns
• Audit logs indicating template editing activity by compromised or malicious admin accounts
• Unexpected child processes spawned by PHP-FPM or web server processes

Detection Strategies

• Monitor Craft CMS template files for unauthorized modifications, particularly those containing create() function calls
• Implement file integrity monitoring on Twig template directories
• Review administrative audit logs for unusual template editing patterns
• Deploy endpoint detection to identify suspicious process execution chains originating from web server processes

Monitoring Recommendations

• Enable comprehensive logging for Craft CMS administrative actions
• Implement real-time alerting for template modifications in production environments
• Monitor for PHP process spawning unexpected child processes such as shell commands
• Review access patterns for administrative accounts to detect potential credential compromise

How to Mitigate CVE-2026-28695

Immediate Actions Required

• Upgrade Craft CMS 5.x installations to version 5.9.0-beta.1 or later immediately
• Upgrade Craft CMS 4.x installations to version 4.17.0-beta.1 or later
• Conduct an immediate audit of all administrative user accounts and revoke unnecessary privileges
• Review recent template modifications for potentially malicious code

Patch Information

The vulnerability has been fixed in Craft CMS versions 5.9.0-beta.1 and 4.17.0-beta.1. The patch addresses the incomplete mitigation from CVE-2025-57811 by implementing additional restrictions on the create() Twig function to prevent arbitrary class instantiation with dangerous constructor arguments.

Security patches and commit details are available in the GitHub Security Advisory GHSA-94rc-cqvm-m4pw. The specific fix can be reviewed in the GitHub Commit e31e508.

Workarounds

• Restrict administrative access to trusted IP addresses only using web server configuration or firewall rules
• Implement additional authentication factors for administrative accounts
• Disable template editing capabilities in production environments where possible
• Consider implementing a Web Application Firewall (WAF) rule to detect and block suspicious Twig template patterns

# Example nginx configuration to restrict admin panel access by IP
location /admin {
    allow 10.0.0.0/8;
    allow 192.168.1.0/24;
    deny all;
    
    # Standard proxy pass configuration
    try_files $uri $uri/ /index.php?$query_string;
}