CVE-2026-28695: 
PHP vulnerability analysis and mitigation

CVE-2026-28695 is an authenticated Remote Code Execution (RCE) vulnerability in Craft CMS caused by Server-Side Template Injection (SSTI) via the create() Twig function combined with a Symfony Process gadget chain. It affects Craft CMS versions 4.0.0-RC1 through 4.16.x and 5.8.7 through 5.8.x, and notably bypasses the prior fix for CVE-2025-57811 (patched in 5.8.7). The vulnerability was disclosed on March 2, 2026, by researcher andreisss, with patches released in 5.9.0-beta.1 and 4.17.0-beta.1. It carries a CVSS v3.1 base score of 7.2 (High) (GitHub Advisory).

The root cause is CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine), with additional classifications of CWE-94 (Code Injection). The create() Twig function directly exposes Craft::createObject(), which permits instantiation of arbitrary PHP classes with attacker-controlled constructor arguments — including Symfony\Component\Process\Process, a bundled dependency that executes shell commands. Exploitation requires admin-level access to the Craft CMS panel and either allowAdminChanges enabled in production or access to the System Messages utility. The fix restricts create() to only instantiate classes that extend yii\base\BaseObject, blocking the Symfony Process gadget chain (GitHub Advisory, Patch Commit).

Successful exploitation grants an authenticated administrator arbitrary code execution on the underlying server, running as the web server user (which may be root in default Docker deployments). This enables full server compromise, including reading, modifying, or deleting sensitive data; installing malware or backdoors; and lateral movement within the network. Confidentiality, integrity, and availability of the affected system are all fully impacted (GitHub Advisory).

A public proof-of-concept payload is included in the GitHub security advisory, making exploitation straightforward for any attacker with admin credentials. As of the time of disclosure, there is no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.043% (low probability of exploitation in the next 30 days), and the vulnerability is not listed in the CISA KEV catalog. No specific threat actor attribution has been reported (GitHub Advisory).

1. Obtain Admin Access: Authenticate to the Craft CMS admin panel using valid administrator credentials (obtained via credential theft, phishing, or brute force).
2. Navigate to Vulnerable Field: Go to Settings → Entry Types and select any existing entry type to edit.
3. Inject SSTI Payload: In the Title Format field, insert the following Twig SSTI payload:

   {% set p = create("Symfony\\Component\\Process\\Process", [["id"]]) %}{{ p.mustRun.getOutput }}

4. Trigger Execution: Create or edit an entry of the modified entry type. Craft CMS renders the Title Format field using Twig, which evaluates the payload.
5. Observe Output: The output of the executed shell command (e.g., id) appears in the entry title, confirming RCE. Replace ["id"] with any desired command (e.g., a reverse shell) to achieve further objectives (GitHub Advisory).

• Logs: Craft CMS application logs showing Twig template rendering errors or unexpected output in entry title fields; web server access logs with admin panel requests to /admin/settings/entry-types or similar endpoints followed by unusual process activity.
• Process: Unexpected child processes spawned by the PHP/web server process (e.g., sh, bash, id, curl, wget, python) that are not typical for normal CMS operation.
• File System: New or modified files in the web root or temp directories created by the web server user; presence of web shells or unauthorized scripts; unexpected cron jobs added under the web server user account.
• Network: Outbound connections from the web server to unknown external IPs or C2 infrastructure, particularly initiated by the PHP process; unusual DNS lookups from the server (GitHub Advisory).

Upgrade Craft CMS to version 5.9.0 or later (for the 5.x branch) or 4.17.0 or later (for the 4.x branch), which restrict the create() Twig function to only instantiate classes extending yii\base\BaseObject. As an interim measure, disable allowAdminChanges in production environments (already recommended by Craft CMS security guidelines) and restrict admin panel access to trusted users only. Monitor admin access logs for unauthorized or suspicious template modifications (GitHub Advisory, Patch Commit).

The vulnerability was reported by researcher andreisss and published to the GitHub Advisory Database on March 3, 2026. The Craft CMS maintainer (brandonkelly) implemented the fix by restricting create() to BaseObject subclasses. No significant broader media coverage or notable community debate has been identified beyond the advisory itself (GitHub Advisory).