Cyber Posture

CVE-2026-28697

CriticalPublic PoC

Published: 04 March 2026

Published
04 March 2026
Modified
05 March 2026
KEV Added
—
Patch
—
CVSS Score 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0020 41.7th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Craft is a content management system (CMS). Prior to 4.17.0-beta.1 and 5.9.0-beta.1, an authenticated administrator can achieve Remote Code Execution (RCE) by injecting a Server-Side Template Injection (SSTI) payload into Twig template fields (e.g., Email Templates). By calling the craft.app.fs.write()…

more

method, an attacker can write a malicious PHP script to a web-accessible directory and subsequently access it via the browser to execute arbitrary system commands. This vulnerability is fixed in 4.17.0-beta.1 and 5.9.0-beta.1.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Validates inputs to Twig template fields like Email Templates to block SSTI payloads that enable RCE via craft.app.fs.write().

SI-2 Flaw Remediation good match
prevent

Requires timely identification, testing, and deployment of patches such as those in Craft 4.17.0-beta.1 and 5.9.0-beta.1 that fix the SSTI vulnerability.

SI-7 Software, Firmware, and Information Integrity good match
detect

Monitors file system integrity to detect unauthorized writes of malicious PHP scripts to web-accessible directories.

Security SummaryAI

CVE-2026-28697 is a critical remote code execution (RCE) vulnerability (CVSS 9.1; AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) affecting Craft, a content management system (CMS). It stems from a Server-Side Template Injection (SSTI) flaw (CWE-1336) in Twig template fields, such as Email Templates, in versions prior to 4.17.0-beta.1 and 5.9.0-beta.1. An authenticated administrator can inject malicious payloads into these fields, exploiting the craft.app.fs.write() method to write arbitrary PHP scripts to web-accessible directories.

The attack requires administrator privileges but can be carried out remotely with low complexity. Once injected, the SSTI payload allows the attacker to persist a malicious PHP file on the server. Accessing this file via a browser triggers execution of arbitrary system commands, potentially leading to full server compromise, data exfiltration, or further lateral movement.

Craft CMS patches this issue in versions 4.17.0-beta.1 and 5.9.0-beta.1. Security practitioners should upgrade immediately and review the GitHub security advisory (GHSA-v47q-jxvr-p68x), commit 9dc2a4a3ec8e9cd5e8c0d1129f36371437519197, and pull requests #18216 and #18219 for implementation details and verification steps.

Details

CWE(s)
CWE-1336

Affected Products

craftcms
craft cms
4.0.0, 5.0.0 · 4.0.0 — 4.17.0 · 5.0.0 — 5.9.0

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1221 Template Injection Stealth
Adversaries may create or modify references in user document templates to conceal malicious code or force authentication attempts.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
Why these techniques?

SSTI in Twig templates directly enables T1221 (Template Injection). As a public-facing CMS, facilitates T1190 (Exploit Public-Facing Application). Allows writing executable PHP scripts to web directories, enabling T1100 (Web Shell).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References