CVE-2026-28784: 
PHP vulnerability analysis and mitigation

CVE-2026-28784 is an authenticated Server-Side Template Injection (SSTI) vulnerability in Craft CMS that allows attackers with sufficient privileges to achieve Remote Code Execution (RCE) via a malicious Twig map filter payload. It affects Craft CMS versions 4.0.0-RC1 through 4.16.x and 5.0.0-RC1 through 5.8.x. The vulnerability was published on March 2, 2026, and reviewed by the GitHub Advisory Database on March 3, 2026 (GitHub Advisory). It carries a CVSS v3.1 base score of 7.2 (High) and a CVSS v4.0 base score of 8.6 (High) (GitHub Advisory).

The root cause is improper neutralization of special elements used in a template engine (CWE-1336), specifically Craft CMS's failure to restrict non-Closure arrow functions within the Twig templating engine. An attacker can craft a malicious payload using the Twig map filter (e.g., names|map('ucfirst')) in text fields that accept Twig input — either via Settings in the Craft Control Panel (when allowAdminChanges is enabled) or via the System Messages utility (accessible to non-administrator accounts with that utility permission) (GitHub Advisory). The fix introduced a new enableTwigSandbox config setting that activates the Twig Sandbox extension, which blocks all non-Closure arrow functions and prevents string-based callable injection (Craft CMS PR #18208).

Successful exploitation allows an authenticated attacker to execute arbitrary code on the server hosting Craft CMS, resulting in full compromise of confidentiality, integrity, and availability of the affected system. An attacker could exfiltrate sensitive data (including database credentials, user data, and application secrets), modify or destroy content, and potentially pivot to other systems accessible from the server (GitHub Advisory). The scope is limited to the vulnerable system itself (no subsequent system impact per CVSS v4.0 metrics), but the high impact across all three CIA pillars makes this a serious risk for any Craft CMS deployment with allowAdminChanges enabled or with loosely scoped System Messages utility access (GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.021% (6th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires either administrator-level access to the Craft Control Panel with allowAdminChanges enabled, or a non-administrator account with access to the System Messages utility — both of which are elevated privilege conditions that limit the attacker pool (GitHub Advisory).

1. Gain privileged access: Obtain administrator credentials to the Craft CMS Control Panel (in environments where allowAdminChanges is enabled), or obtain credentials for a non-administrator account that has been granted access to the System Messages utility.
2. Navigate to a vulnerable input field: Log into the Craft Control Panel and navigate to Settings (for admin accounts with allowAdminChanges enabled) or to the System Messages utility (for accounts with that utility access).
3. Craft a malicious Twig payload: Insert a Twig SSTI payload leveraging the map filter with a string-based callable (non-Closure arrow function), for example: {{ ['id']|map('system') }} or similar expressions that invoke PHP functions through Twig's template evaluation.
4. Trigger template rendering: Save the malicious input and trigger a page or action that causes Craft CMS to render the Twig template containing the payload.
5. Achieve RCE: The Twig engine evaluates the injected expression, executing arbitrary PHP/system commands on the server as the web server process user, enabling data exfiltration, reverse shell establishment, or further lateral movement (GitHub Advisory, Craft CMS PR #18208).

• Logs: Craft CMS application logs showing unexpected Twig rendering errors or unusual template evaluation activity in Settings or System Messages contexts; web server access logs with POST requests to /admin/settings/ or /admin/utilities/system-messages containing encoded Twig expressions.
• File System: Unexpected new files (web shells, scripts) written to the Craft CMS web root or storage directories; modification timestamps on template or config files inconsistent with normal deployment activity.
• Process: Unusual child processes spawned by the PHP-FPM or web server process (e.g., bash, sh, curl, wget, python) that are not part of normal Craft CMS operation.
• Network: Outbound connections from the web server to unknown external IP addresses or domains, particularly on non-standard ports, following admin panel activity.

Craft CMS has released patched versions: 5.8.22 (5.x branch) and 4.16.18 (4.x branch); upgrading to these or later versions is the primary recommended remediation (GitHub Advisory). As a configuration-based mitigation, set allowAdminChanges to false in all production environments, which is already Craft CMS's documented security recommendation (Craft CMS Security Guide). Additionally, restrict access to the System Messages utility to only fully trusted users, and enable the new enableTwigSandbox config setting introduced in PR #18208 to enforce Twig sandbox restrictions (Craft CMS PR #18208).

The vulnerability was discovered by security researchers RajChowdhury240 (finder) and rlarabee (reporter), and was responsibly disclosed to the Craft CMS team (GitHub Advisory). The Craft CMS maintainer (brandonkelly) addressed the issue by introducing a Twig sandbox configuration option that disallows non-Closure arrow functions, with the fix merged on January 2, 2026 (Craft CMS PR #18208). Community reaction has been limited given the elevated privilege requirement, with the advisory rated "Moderate" severity by GitHub despite the High CVSS scores, reflecting the constrained exploitation conditions.