CVE-2026-28783: Craft has a Twig Function Blocklist Bypass
Craft CMS implements a blocklist to prevent potentially dangerous PHP functions from being called via Twig non-Closure arrow functions.
In order to be able to successfully execute this attack, you need to either have allowAdminChanges enabled on production, or a compromised admin account, or an account with access to the System Messages utility.
Several PHP functions are not included in the blocklist, which could allow malicious actors with the required permissions to execute various types of payloads, including RCEs, arbitrary file reads, SSRFs, and SSTIs.
Twig has already deprecated this behavior, and it will eventually be removed from Twig altogether.
https://github.com/twigphp/Twig/blob/946ddeafa3c9f4ce279d1f34051af041db0e16f2/src/Extension/CoreExtension.php#L2096
This has been resolved in Craft 4.17.0 and 5.9.0, which removes the blocklist and disables all non-Clousure arrow functions in Twig globally via the enableTwigSandbox config setting. That setting is enabled by default on all new Craft projects. Existing Craft projects will need to enable the config setting to take advantage of it.
Existing projects should update to the patched versions of 5.9.0 and 4.17.0 to mitigate the issue and enable the config setting.
Resources
https://github.com/craftcms/cms/pull/18208
Other sources
Craft is a content management system (CMS). Prior to 5.9.0-beta.1 and 4.17.0-beta.1, Craft CMS implements a blocklist to prevent potentially dangerous PHP functions from being called via Twig non-Closure arrow functions. In order to be able to successfully execute this attack, you need to either have allowAdminChanges enabled on production, or a compromised admin account, or an account with access to the System Messages utility. Several PHP functions are not included in the blocklist, which could allow malicious actors with the required permissions to execute various types of payloads, including RCEs, arbitrary file reads, SSRFs, and SSTIs. This vulnerability is fixed in 5.9.0-beta.1 and 4.17.0-beta.1.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28783?
CVE-2026-28783 has a high severity due to its potential exploitation via Twig function blocklist bypass.
How do I fix CVE-2026-28783?
To fix CVE-2026-28783, upgrade to Craft CMS version 4.17.0-beta.1 or 5.9.0-beta.1.
What versions are affected by CVE-2026-28783?
CVE-2026-28783 affects Craft CMS versions from 4.0.0-RC1 up to 4.17.0-beta.1 and from 5.0.0-RC1 up to 5.9.0-beta.1.
What is the exploit method for CVE-2026-28783?
The exploit method for CVE-2026-28783 involves bypassing the blocklist for potentially dangerous PHP functions when `allowAdminChanges` is enabled.
What is the impact of CVE-2026-28783?
The impact of CVE-2026-28783 includes the potential execution of arbitrary PHP functions, leading to security vulnerabilities.