Craft is a content management system

CVE-2026-28697 is an authenticated admin-side SSTI-to-RCE flaw in Craft CMS. A user with an administrator account can inject Twig into system message or email template fields, call craft.app.fs.write() or related paths, drop a PHP webshell into a web-accessible filesystem or volume, and then execute OS commands through the browser. The affected ranges documented by GitHub/NVD are >= 4.0.0-RC1, < 4.17.0-beta.1 and >= 5.0.0-RC1, < 5.9.0-beta.1.

The vendor/NVD CRITICAL label reflects raw impact after exploitation, not the real attack chain. In practice this is post-auth, admin-only, frequently gated by allowAdminChanges, and further narrowed by needing a writable web-accessible filesystem or volume plus a reachable template-render path. That makes it a serious containment problem after control-plane compromise, but not an internet-wormable or broad pre-auth emergency.

Why this verdict

• Start from 9.1, then subtract for PR:H: this requires authenticated administrator access or equivalent utility permissions, which implies the attacker has already crossed your identity and control-plane defenses.
• Subtract again for population narrowing: only Craft CMS versions in the 4.x/5.x affected bands matter, and not every enterprise even runs Craft at meaningful scale.
• Subtract for production hardening friction: Craft's own docs recommend allowAdminChanges=false in production, which removes the easiest attack path in mature deployments.
• Subtract for chain complexity after auth: successful weaponization still needs a writable web-accessible filesystem or volume plus a render trigger, so raw impact is broader than real reachability.
• Add back some severity for host compromise impact: if the chain lands, the attacker can execute commands, expose .env secrets, and pivot from the web tier.

Why not higher?

This is not unauthenticated remote code execution, and it is not a broad one-click admin browser bug. The chain assumes prior compromise of an administrator or delegated privileged user, and many production deployments break the path with allowAdminChanges=false, non-executable upload paths, or restricted admin exposure.

Why not lower?

Once the prerequisites are met, the outcome is real server-side code execution and secret disclosure, not a cosmetic admin-panel issue. For organizations that do expose Craft admin interfaces or run looser production configs, this can become the cleanest path from CMS-admin compromise to web-tier takeover.

1. Disable admin changes in production — Set allowAdminChanges=false anywhere it is operationally viable. This directly breaks the most straightforward attack prerequisite, and because this is a MEDIUM reassessment there is no mitigation SLA — implement during your next hardening cycle rather than treating it as emergency change work.
2. Put /admin behind stronger access controls — Require SSO, MFA, VPN or IP allowlisting for the Craft control panel so the attacker cannot satisfy the PR:H prerequisite cheaply. There is no mitigation SLA — use your normal identity-hardening window, but prioritize any internet-exposed admin surface.
3. Block PHP execution from writable paths — Ensure upload directories, volumes, and other app-writable locations cannot execute PHP or other server-side code. That severs the PoC's write shell -> browse to shell chain even if a template payload lands; for a MEDIUM finding there is no mitigation SLA, so roll this into your standard web-stack hardening work.
4. Audit admin role and utility permissions — Review who can reach System Messages, Email settings, and other template-edit surfaces; remove dormant admins and enforce least privilege. There is no mitigation SLA — apply in your normal access-review cadence, but do not leave broad shared admin accounts in place.
5. Monitor for new executable files in served storage — Use FIM/EDR to alert on .php or unexpected executable content created under web-served storage and uploads. There is no mitigation SLA for this severity bucket, but this control has outsized value because it catches both exploitation and other CMS abuse paths.

Run this on the Craft application host in the application root that contains composer.lock, composer.json, or vendor/craftcms/cms. Invoke it as bash verify-cve-2026-28697.sh /var/www/craft (replace the path with your install root). No root is required; read access to the app directory is enough.

#!/usr/bin/env bash
# verify-cve-2026-28697.sh
# Checks whether a local Craft CMS installation is in the vulnerable version range for CVE-2026-28697.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

APP_ROOT="${1:-.}"

if [[ ! -d "$APP_ROOT" ]]; then
  echo "UNKNOWN - target path does not exist: $APP_ROOT"
  exit 2
fi

find_version() {
  local root="$1"
  local v=""

  # 1) composer.lock
  if [[ -f "$root/composer.lock" ]]; then
    v=$(php -r '
      $f=$argv[1];
      $j=json_decode(file_get_contents($f), true);
      if (!is_array($j)) exit(1);
      foreach (["packages","packages-dev"] as $bucket) {
        if (!empty($j[$bucket]) && is_array($j[$bucket])) {
          foreach ($j[$bucket] as $pkg) {
            if (($pkg["name"] ?? "") === "craftcms/cms") {
              $ver = $pkg["version"] ?? "";
              $ver = preg_replace("/^v/", "", $ver);
              echo $ver;
              exit(0);
            }
          }
        }
      }
      exit(1);
    ' "$root/composer.lock" 2>/dev/null || true)
    if [[ -n "$v" ]]; then
      echo "$v"
      return 0
    fi
  fi

  # 2) vendor package composer.json
  if [[ -f "$root/vendor/craftcms/cms/composer.json" ]]; then
    v=$(php -r '
      $f=$argv[1];
      $j=json_decode(file_get_contents($f), true);
      $ver = $j["version"] ?? "";
      $ver = preg_replace("/^v/", "", $ver);
      echo $ver;
    ' "$root/vendor/craftcms/cms/composer.json" 2>/dev/null || true)
    if [[ -n "$v" ]]; then
      echo "$v"
      return 0
    fi
  fi

  # 3) composer show fallback
  if command -v composer >/dev/null 2>&1 && [[ -f "$root/composer.json" ]]; then
    v=$(cd "$root" && composer show craftcms/cms --format=json 2>/dev/null | php -r '
      $j=json_decode(stream_get_contents(STDIN), true);
      $ver = $j["versions"][0] ?? ($j["version"] ?? "");
      $ver = preg_replace("/^v/", "", $ver);
      echo $ver;
    ' 2>/dev/null || true)
    if [[ -n "$v" ]]; then
      echo "$v"
      return 0
    fi
  fi

  return 1
}

VERSION="$(find_version "$APP_ROOT" || true)"

if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN - could not determine installed craftcms/cms version"
  exit 2
fi

RESULT=$(php -r '
  $v = preg_replace("/^v/", "", $argv[1]);

  $isVuln = false;

  # Affected ranges per GHSA/NVD:
  # >= 4.0.0-RC1, < 4.17.0-beta.1
  # >= 5.0.0-RC1, < 5.9.0-beta.1
  if (version_compare($v, "4.0.0-RC1", ">=") && version_compare($v, "4.17.0-beta.1", "<")) {
      $isVuln = true;
  }
  if (version_compare($v, "5.0.0-RC1", ">=") && version_compare($v, "5.9.0-beta.1", "<")) {
      $isVuln = true;
  }

  echo $isVuln ? "VULNERABLE" : "PATCHED";
' "$VERSION" 2>/dev/null || true)

if [[ "$RESULT" == "VULNERABLE" ]]; then
  echo "VULNERABLE - craftcms/cms $VERSION is in the affected range for CVE-2026-28697"
  exit 1
elif [[ "$RESULT" == "PATCHED" ]]; then
  echo "PATCHED - craftcms/cms $VERSION is outside the affected range for CVE-2026-28697"
  exit 0
else
  echo "UNKNOWN - version comparison failed for detected version: $VERSION"
  exit 2
fi

Sources

1. NVD CVE-2026-28697
2. GitHub Security Advisory GHSA-v47q-jxvr-p68x
3. Craft CMS fix commit 9dc2a4a
4. Craft docs: `allowAdminChanges`
5. Craft docs: Email / System Messages / Twig sandbox
6. CISA Known Exploited Vulnerabilities Catalog
7. FIRST EPSS API documentation
8. MITRE CWE-1336