Vulnerability Description
Craft is a content management system (CMS). Prior to 4.17.0-beta.1 and 5.9.0-beta.1, an authenticated administrator can achieve Remote Code Execution (RCE) by injecting a Server-Side Template Injection (SSTI) payload into Twig template fields (e.g., Email Templates). By calling the craft.app.fs.write() method, an attacker can write a malicious PHP script to a web-accessible directory and subsequently access it via the browser to execute arbitrary system commands. This vulnerability is fixed in 4.17.0-beta.1 and 5.9.0-beta.1.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Craftcms | Craft Cms | < 4.17.0 |
Related Weaknesses (CWE)
References
- https://github.com/craftcms/cms/commit/9dc2a4a3ec8e9cd5e8c0d1129f36371437519197Patch
- https://github.com/craftcms/cms/pull/18216Issue TrackingPatch
- https://github.com/craftcms/cms/pull/18219Issue TrackingPatch
- https://github.com/craftcms/cms/security/advisories/GHSA-v47q-jxvr-p68xExploitMitigationPatch
FAQ
What is CVE-2026-28697?
CVE-2026-28697 is a vulnerability with a CVSS score of 9.1 (CRITICAL). Craft is a content management system (CMS). Prior to 4.17.0-beta.1 and 5.9.0-beta.1, an authenticated administrator can achieve Remote Code Execution (RCE) by injecting a Server-Side Template Injectio...
How severe is CVE-2026-28697?
CVE-2026-28697 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-28697?
Check the references section above for vendor advisories and patch information. Affected products include: Craftcms Craft Cms.