Craft is a content management system

CVE-2026-28695 is a Craft CMS server-side template injection path to code execution. In affected craftcms/cms versions >=4.0.0-RC1, <4.17.0-beta.1 and >=5.8.7, <5.9.0-beta.1, the Twig create() function can instantiate attacker-chosen PHP classes; when paired with Symfony\Component\Process\Process, that becomes command execution on the server. The advisory explicitly calls out post-auth exploitation through the control panel, such as an Entry Type Title Format field, and says exploitation requires administrator permissions or access to the System Messages utility.

The vendor's HIGH label captures the technical impact, but it overshoots enterprise patch priority a bit because the decisive gate is privileged authenticated access. This is not an unauthenticated internet spray flaw, not a wormable edge bug, and not KEV-listed; it is a reliable post-auth RCE that matters most where Craft admin access is broad, shared, or externally reachable.

Why this verdict

• Downgraded for PR:H: the attacker must already hold administrator rights or System Messages utility access, which implies prior compromise, insider misuse, or another auth chain.
• Further downgraded for reachability friction: the named settings path depends on allowAdminChanges in production, and Craft explicitly recommends disabling that in prod.
• Not downgraded below MEDIUM because impact is real RCE: once the preconditions are met, exploitation is straightforward, public-PoC-backed, and can end in full host compromise.

Why not higher?

This is not an unauthenticated edge bug, not KEV-listed, and not a low-privilege user-to-root scenario. Every serious attack chain starts with the attacker already crossing your authentication and authorization boundary, which is a major downward pressure on urgency.

Why not lower?

If the attacker has the required role, this is not a nuisance bug—it is a clean path from CMS privilege to server command execution. That jump from application administration to host-level execution materially increases blast radius, especially on weakly isolated containers or shared web infrastructure.

1. Disable admin changes in production — Set allowAdminChanges=false on production Craft instances to remove the easiest control-panel path called out in the advisory. For a MEDIUM verdict there is no noisgate mitigation SLA, so treat this as hardening you should roll in with normal config governance rather than emergency change windows.
2. Restrict control-panel access — Put the Craft admin path behind SSO + MFA, IP allowlisting, VPN, or a reverse-proxy access policy so fewer identities can ever satisfy the vuln's first prerequisite. This directly attacks the most important risk factor: privileged authenticated reachability.
3. Tighten utility permissions — Review who can access System Messages and similar high-trust control-panel features, and remove that access from broad admin or content teams. The GHSA explicitly treats that utility as an alternate exploitation route.
4. Alert on PHP child processes — Create EDR/SIEM detections for php-fpm, apache2, or nginx spawning shells or process-execution children. This helps catch successful exploit attempts and follow-on activity even if the malicious payload is tucked inside legitimate CMS content.
5. Inventory Craft by package version — Use SBOM, Composer lockfile parsing, or app inventory to identify craftcms/cms in the affected ranges and queue upgrades inside the normal remediation program. This flaw is much easier to manage through software inventory than through perimeter scanning.

Run this on the target Craft host from the application root that contains composer.lock or vendor/. Invoke it as bash ./check-cve-2026-28695.sh /var/www/craft-app. It needs only read access to the app files; no root is required.

#!/usr/bin/env bash
# check-cve-2026-28695.sh
# Determine whether a Craft CMS installation is vulnerable to CVE-2026-28695
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

APP_ROOT="${1:-.}"
COMPOSER_LOCK="$APP_ROOT/composer.lock"
COMPOSER_JSON="$APP_ROOT/composer.json"

have_cmd() {
  command -v "$1" >/dev/null 2>&1
}

ver_ge() {
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | tail -n1)" = "$1" ]
}

ver_lt() {
  [ "$1" != "$2" ] && [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" = "$1" ]
}

extract_version_php() {
  local file="$1"
  php -r '
    $f = $argv[1];
    if (!is_file($f)) { exit(2); }
    $j = json_decode(file_get_contents($f), true);
    if (!is_array($j)) { exit(3); }
    $pkgs = [];
    if (isset($j["packages"]) && is_array($j["packages"])) $pkgs = array_merge($pkgs, $j["packages"]);
    if (isset($j["packages-dev"]) && is_array($j["packages-dev"])) $pkgs = array_merge($pkgs, $j["packages-dev"]);
    foreach ($pkgs as $p) {
      if (($p["name"] ?? "") === "craftcms/cms") {
        echo $p["version"] ?? "";
        exit(0);
      }
    }
    exit(4);
  ' "$file" 2>/dev/null
}

normalize() {
  local v="$1"
  v="${v#v}"
  printf '%s' "$v"
}

if ! have_cmd php; then
  echo "UNKNOWN: php CLI not found"
  exit 2
fi

VERSION=""
SOURCE=""

if [ -f "$COMPOSER_LOCK" ]; then
  VERSION="$(extract_version_php "$COMPOSER_LOCK")"
  if [ -n "$VERSION" ]; then
    SOURCE="$COMPOSER_LOCK"
  fi
fi

if [ -z "$VERSION" ] && [ -f "$COMPOSER_JSON" ]; then
  # Fallback: infer declared constraint, not installed version
  VERSION="$(php -r '
    $f = $argv[1];
    $j = json_decode(file_get_contents($f), true);
    if (!is_array($j)) exit(1);
    $req = $j["require"]["craftcms/cms"] ?? "";
    echo is_string($req) ? $req : "";
  ' "$COMPOSER_JSON" 2>/dev/null)"
  if [ -n "$VERSION" ]; then
    echo "UNKNOWN: only composer constraint found in $COMPOSER_JSON -> $VERSION"
    exit 2
  fi
fi

if [ -z "$VERSION" ]; then
  echo "UNKNOWN: could not determine installed craftcms/cms version from $APP_ROOT"
  exit 2
fi

RAW_VERSION="$VERSION"
VERSION="$(normalize "$VERSION")"

# Exact vulnerable ranges from advisory:
# 4.0.0-RC1 <= v < 4.17.0-beta.1
# 5.8.7 <= v < 5.9.0-beta.1

if ver_ge "$VERSION" "4.0.0-RC1" && ver_lt "$VERSION" "4.17.0-beta.1"; then
  echo "VULNERABLE: craftcms/cms $RAW_VERSION detected from $SOURCE (matches 4.x vulnerable range for CVE-2026-28695)"
  exit 1
fi

if ver_ge "$VERSION" "5.8.7" && ver_lt "$VERSION" "5.9.0-beta.1"; then
  echo "VULNERABLE: craftcms/cms $RAW_VERSION detected from $SOURCE (matches 5.x vulnerable range for CVE-2026-28695)"
  exit 1
fi

if ver_ge "$VERSION" "5.9.0-beta.1" || ver_ge "$VERSION" "4.17.0-beta.1"; then
  echo "PATCHED: craftcms/cms $RAW_VERSION detected from $SOURCE"
  exit 0
fi

echo "PATCHED: craftcms/cms $RAW_VERSION detected from $SOURCE (outside known vulnerable ranges for CVE-2026-28695)"
exit 0

Sources

1. NVD CVE record
2. GitHub Advisory Database JSON for GHSA-94rc-cqvm-m4pw
3. Craft CMS fix commit e31e508
4. Craft docs: allowAdminChanges
5. Craft docs: System Messages are Twig-evaluated
6. Craft supported versions / lifecycle
7. CISA Known Exploited Vulnerabilities Catalog
8. Censys advisory noting exposed Craft CMS population