CVE-2026-28784: Craft is affected by potential authenticated Remote Code Execution via Twig SSTI
Craft is a content management system (CMS). Prior to 5.8.22 and 4.16.18, it is possible to craft a malicious payload using the Twig map filter in text fields that accept Twig input under Settings in the Craft control panel or using the System Messages utility, which could lead to a RCE. For this to work, you must have administrator access to the Craft Control Panel, and allowAdminChanges must be enabled for this to work, which is against our recommendations for any non-dev environment. Alternatively, you can have a non-administrator account with allowAdminChanges disabled, but you have access to the System Messages utility. Users should update to the patched versions (5.8.22 and 4.16.18) to mitigate the issue.
Other sources
For this to work, the attacker must have administrator access to the Craft Control Panel, and allowAdminChanges must be enabled, which is against Craft CMS' recommendations for any non-dev environment.
https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production
Alternatively, they can have a non-administrator account with allowAdminChanges disabled, but they must have access to the System Messages utility.
It is possible to craft a malicious payload using the Twig map filter in text fields that accept Twig input under Settings in the Craft control panel or using the System Messages utility, which could lead to a RCE.
Users should update to the patched versions (5.8.22 and 4.16.18) to mitigate the issue.
References:
https://github.com/craftcms/cms/pull/18208
— GitHub
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28784?
CVE-2026-28784 has been designated with a high severity rating due to the potential for authenticated Remote Code Execution.
How do I fix CVE-2026-28784?
To fix CVE-2026-28784, upgrade to Craft CMS version 4.17.0-beta.1 or 5.9.0-beta.1 or later.
What versions of Craft CMS are affected by CVE-2026-28784?
CVE-2026-28784 affects Craft CMS versions prior to 4.17.0-beta.1 and 5.9.0-beta.1.
Is CVE-2026-28784 a Remote Code Execution vulnerability?
Yes, CVE-2026-28784 allows for potential authenticated Remote Code Execution through Twig SSTI.
What components of Craft CMS are vulnerable in CVE-2026-28784?
CVE-2026-28784 impacts the Twig map filter used in text fields that accept Twig input under Settings in the Craft control panel.