CVE-2026-28783: 
PHP vulnerability analysis and mitigation

CVE-2026-28783 is a Twig function blocklist bypass vulnerability in Craft CMS that allows privileged attackers to execute arbitrary code, read files, conduct SSRF attacks, and perform server-side template injection (SSTI). It affects Craft CMS versions >= 4.0.0-RC1 and < 4.17.0, and >= 5.0.0-RC1 and < 5.9.0. The vulnerability was published on March 2, 2026, and patched in versions 4.17.0 and 5.9.0. It carries a CVSS v3.1 base score of 9.1 (Critical) and a CVSS v4.0 base score of 9.4 (Critical) (GitHub Advisory, Craft CMS Advisory).

The root cause is an incomplete PHP function blocklist (CWE-184) used by Craft CMS to restrict dangerous PHP functions callable via Twig non-Closure arrow functions, compounded by improper neutralization of template engine special elements (CWE-1336) and code injection (CWE-94). Twig supports passing string function names as arrow function callbacks (e.g., names|map('ucfirst')), and Craft's blocklist failed to enumerate all dangerous PHP functions, leaving gaps that could be exploited. Exploitation requires either allowAdminChanges enabled on production, a compromised admin account, or access to the System Messages utility — all of which allow template content to be injected and evaluated. The fix, implemented in PR #18208, removes the blocklist approach entirely and instead enables Twig's Sandbox extension via a new enableTwigSandbox config setting, which globally disables all non-Closure arrow functions (GitHub Advisory, Craft CMS PR).

Successful exploitation allows an attacker with the required privileges to execute arbitrary remote code on the server, read sensitive files from the filesystem, conduct server-side request forgery (SSRF) to access internal resources, and perform server-side template injection (SSTI). These capabilities can lead to complete system compromise, sensitive data exfiltration, and lateral movement within the hosting infrastructure. All three pillars of the CIA triad — confidentiality, integrity, and availability — are rated HIGH in the CVSS scoring (GitHub Advisory, Craft CMS Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of this report (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.062%, placing it in the 11th percentile for exploitation likelihood within 30 days. Exploitation requires high privileges (admin account or System Messages utility access), which significantly limits the attack surface compared to unauthenticated vulnerabilities.

1. Gain privileged access: Obtain admin credentials via phishing, credential stuffing, or another compromise vector, or identify a Craft CMS instance with allowAdminChanges enabled in production, or gain access to the System Messages utility.
2. Identify vulnerable version: Confirm the target is running Craft CMS 4.x < 4.17.0 or 5.x < 5.9.0 by inspecting version indicators in the admin panel or HTTP response headers.
3. Locate template injection point: Navigate to a feature that renders Twig templates with user-controlled input, such as the System Messages utility or admin-editable template fields.
4. Craft malicious Twig payload: Inject a non-Closure arrow function referencing a PHP function not on the blocklist. For example, use a Twig filter with a string callback to invoke a dangerous PHP function (e.g., items|map('system') or similar unlisted functions) to achieve RCE, file read, or SSRF.
5. Execute payload: Submit the crafted template content. Craft CMS evaluates the Twig expression, invoking the unblocked PHP function and executing the attacker's payload on the server.
6. Achieve objective: Depending on the payload, exfiltrate sensitive data, establish a reverse shell, read configuration files (e.g., .env with database credentials), or pivot to internal services via SSRF (GitHub Advisory, Craft CMS Advisory).

• Logs: Craft CMS application logs showing unusual Twig rendering errors or PHP function calls originating from System Messages or admin template fields; web server access logs with POST requests to admin template editing endpoints from unexpected IPs.
• File System: Unexpected new files (web shells, scripts) written to the Craft CMS web root or storage directories; modifications to .env or configuration files indicating credential access.
• Network: Outbound HTTP requests from the web server to internal network addresses or unexpected external hosts (indicative of SSRF exploitation); unusual outbound connections on non-standard ports from the PHP/web server process.
• Process: Unexpected child processes spawned by the PHP-FPM or web server process (e.g., sh, bash, curl, wget) executing system commands.

Update Craft CMS to version 4.17.0 (for the 4.x branch) or 5.9.0 (for the 5.x branch), which remove the blocklist and disable all non-Closure arrow functions in Twig via the new enableTwigSandbox config setting. This setting is enabled by default on new Craft projects, but existing projects must manually enable it in their configuration after upgrading to benefit from the protection. As additional hardening measures, disable allowAdminChanges on production environments and restrict access to the System Messages utility to trusted personnel only (GitHub Advisory, Craft CMS PR).

The vulnerability was reported by security researcher mHe4am and the fix was implemented by Craft CMS core developer brandonkelly via PR #18208, merged on January 2, 2026 (Craft CMS PR). The advisory notes that Twig itself has already deprecated the non-Closure arrow function behavior and plans to remove it in a future version, aligning the Craft CMS fix with the upstream Twig project's direction. No significant broader media coverage or notable community controversy has been identified beyond the standard advisory publication.