by Kastro
Paper/Archive/CVE-2026-28697

CVE-2026-28697

craftcms cms — Craft Affected by Authenticated RCE via "craft.app.fs.write()" in Twig Templates

EPSS 1%public exploitCVSS 9.4
critical.is priorityof 100
52
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 67.9.679 × 2013.6Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Craft is a content management system (CMS). Prior to 4.17.0-beta.1 and 5.9.0-beta.1, an authenticated administrator can achieve Remote Code Execution (RCE) by injecting a Server-Side Template Injection (SSTI) payload into Twig template fields (e.g., Email Templates). By calling the craft.app.fs.write() method, an attacker can write a malicious PHP script to a web-accessible directory and subsequently access it via the browser to execute arbitrary system commands. This vulnerability is fixed in 4.17.0-beta.1 and 5.9.0-beta.1.

Affected

ProductAffectedFixed inSource
cms>= 5.0.0-RC1, < 5.9.0-beta.1–CNA
cms>= 4.0.0-RC1, < 4.17.0-beta.1–CNA

Scores by source

GitHub_M (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
NVD9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refgithub.com/craftcms/cms/security/advisories/GHSA-v47q-jxvr-p68xrefgithub.com/craftcms/cms/pull/18216refgithub.com/craftcms/cms/pull/18219refgithub.com/craftcms/cms/commit/9dc2a4a3ec8e9cd5e8c0d1129f36371437519197