Craft is a content management system

CVE-2026-28783 is a Twig blocklist-bypass in Craft CMS that can turn privileged template access into PHP function execution. The affected lines are Craft 4 from 4.0.0-RC1 up to before 4.17.0, and Craft 5 from 5.0.0-RC1 up to before 5.9.0; the advisory text also references 4.17.0-beta.1 and 5.9.0-beta.1 during disclosure. The bug sits in Craft’s handling of non-Closure Twig arrow functions, where the denylist missed dangerous PHP-call paths.

The vendor/NVD-style 9.1 CRITICAL score overstates enterprise urgency because the decisive prerequisite is not network reachability, it is *already having high-value application privileges* or a compromised admin. In real fleets, PR:H here means post-initial-access, post-credential-theft, or a bad production practice like allowAdminChanges=true; that narrows the reachable population hard enough to downgrade this from internet-burner to authenticated-abuse.

Why this verdict

• Downgrade for attacker position: PR:H is not cosmetic here; it means the attacker already owns a privileged app account, an admin session, or a misconfigured production environment.
• Downgrade for exposure fraction: plenty of Craft sites are public-facing, but only a subset expose the exact authenticated utility path *and* delegate the needed permissions beyond trusted admins.
• Downgrade for modern controls: MFA, SSO conditional access, admin VPN/IP gating, and EDR on web servers should stop the chain before or immediately after the vulnerable step.
• Keep it above LOW because impact is severe: if the attacker clears the privilege hurdle, the blast radius can jump to server-side code execution, arbitrary file reads, SSRF, and secret theft.

Why not higher?

Because this is not pre-auth and not broadly wormable. A CVE that requires internal authenticated privilege in a CMS control plane is inherently narrower than the classic public-edge RCEs that actually melt patch queues.

Why not lower?

Because the post-condition is still dangerous: this can become full web-tier compromise, not just a mild information leak. Also, Craft is often internet-facing, so the set of organizations with reachable admin surfaces is non-trivial even if the exploit path itself is privileged.

1. Set allowAdminChanges to false in production — This directly removes one of the vendor-stated prerequisites and shrinks the reachable attack surface. For a MEDIUM verdict there is no noisgate mitigation SLA — go straight to the 365-day remediation window, but this is cheap enough to do in the next normal change window.
2. Enable enableTwigSandbox on existing projects — Craft’s own guidance says existing projects must explicitly enable this to get the stricter Twig behavior. For a MEDIUM verdict there is no mitigation SLA, so deploy during regular configuration management and complete before the remediation deadline.
3. Strip System Messages utility access from non-admin roles — The advisory explicitly names access to the System Messages utility as a sufficient condition. Audit RBAC now, remove that permission from editor/power-user roles where it is not strictly needed, and treat completion as part of the 365-day remediation window if not already standard.
4. Gate admin access behind VPN or IP allowlists — This adds meaningful friction to the prerequisite stage by converting a public authenticated surface into a managed admin enclave. There is no mitigation SLA for a MEDIUM verdict, but this is a strong standing control for all CMS admin planes.
5. Alert on control-plane Twig and system-message changes — Most orgs have poor visibility into CMS administrative content changes; add logging and alerting for edits to system messages, admin utilities, and template-bearing settings. This will not prevent the bug, but it shortens time-to-detect during the long remediation window.

Run this on the Craft application host from the project root, or pass the root as an argument: ./check-cve-2026-28783.sh /var/www/craft-app. It needs local read access to composer.lock, vendor/, and config/; no root is required unless file permissions are locked down.

#!/usr/bin/env bash
# check-cve-2026-28783.sh
# Detect likely exposure to CVE-2026-28783 in Craft CMS.
# Outputs one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=usage/runtime error

set -u

APP_ROOT="${1:-.}"

if ! command -v php >/dev/null 2>&1; then
  echo "UNKNOWN - php not found; cannot evaluate Craft version"
  exit 2
fi

if [ ! -d "$APP_ROOT" ]; then
  echo "UNKNOWN - app root not found: $APP_ROOT"
  exit 3
fi

get_version_from_composer_lock() {
  local lock="$1/composer.lock"
  [ -f "$lock" ] || return 1
  php -r '
    $f = $argv[1];
    $j = json_decode(file_get_contents($f), true);
    if (!$j) exit(1);
    $pkgs = array_merge($j["packages"] ?? [], $j["packages-dev"] ?? []);
    foreach ($pkgs as $p) {
      if (($p["name"] ?? "") === "craftcms/cms") {
        $v = $p["version"] ?? "";
        $v = ltrim($v, "vV");
        echo $v;
        exit(0);
      }
    }
    exit(1);
  ' "$lock"
}

get_version_from_vendor() {
  local cj="$1/vendor/craftcms/cms/composer.json"
  [ -f "$cj" ] || return 1
  php -r '
    $f = $argv[1];
    $j = json_decode(file_get_contents($f), true);
    if (!$j) exit(1);
    $v = $j["version"] ?? "";
    if (!$v) exit(1);
    echo ltrim($v, "vV");
  ' "$cj"
}

get_version_from_cli() {
  if [ -f "$1/craft" ]; then
    (cd "$1" && php craft --version 2>/dev/null) | awk '{print $NF}' | sed 's/^v//'
    return 0
  fi
  return 1
}

version_compare_php() {
  # args: v1 op v2
  php -r 'exit(version_compare($argv[1], $argv[3], $argv[2]) ? 0 : 1);' "$1" "$2" "$3"
}

is_affected() {
  local v="$1"
  if version_compare_php "$v" ">=" "4.0.0-RC1" && version_compare_php "$v" "<" "4.17.0"; then
    return 0
  fi
  if version_compare_php "$v" ">=" "5.0.0-RC1" && version_compare_php "$v" "<" "5.9.0"; then
    return 0
  fi
  return 1
}

is_in_fixed_major() {
  local v="$1"
  if version_compare_php "$v" ">=" "4.17.0" && version_compare_php "$v" "<" "5.0.0"; then
    return 0
  fi
  if version_compare_php "$v" ">=" "5.9.0"; then
    return 0
  fi
  return 1
}

sandbox_enabled() {
  # Best-effort check only. Existing projects may need this explicitly enabled.
  local root="$1"
  local files=""
  [ -f "$root/config/general.php" ] && files="$files $root/config/general.php"
  if [ -d "$root/config" ]; then
    # shellcheck disable=SC2046
    files="$files $(find "$root/config" -maxdepth 2 -type f \( -name '*.php' -o -name '*.php.dist' \) 2>/dev/null)"
  fi
  [ -n "$files" ] || return 1
  grep -Eqs "enableTwigSandbox[[:space:]]*=>[[:space:]]*true|['\"]enableTwigSandbox['\"][[:space:]]*=>[[:space:]]*true" $files
}

VERSION=""
VERSION="$(get_version_from_composer_lock "$APP_ROOT" 2>/dev/null)" || true
if [ -z "$VERSION" ]; then
  VERSION="$(get_version_from_vendor "$APP_ROOT" 2>/dev/null)" || true
fi
if [ -z "$VERSION" ]; then
  VERSION="$(get_version_from_cli "$APP_ROOT" 2>/dev/null)" || true
fi

if [ -z "$VERSION" ]; then
  echo "UNKNOWN - unable to determine Craft CMS version from composer.lock, vendor metadata, or CLI"
  exit 2
fi

if is_affected "$VERSION"; then
  echo "VULNERABLE - Craft CMS version $VERSION is in the affected range for CVE-2026-28783"
  exit 1
fi

if is_in_fixed_major "$VERSION"; then
  if sandbox_enabled "$APP_ROOT"; then
    echo "PATCHED - Craft CMS version $VERSION is fixed and enableTwigSandbox appears enabled"
    exit 0
  else
    echo "UNKNOWN - Craft CMS version $VERSION is fixed, but enableTwigSandbox was not confirmed from local config"
    exit 2
  fi
fi

echo "PATCHED - Craft CMS version $VERSION is outside the affected major/version ranges for CVE-2026-28783"
exit 0

Sources

1. NVD CVE-2026-28783
2. GitHub Security Advisory GHSA-5fvc-7894-ghp4
3. Craft CMS pull request #18208
4. OSV entry for CVE-2026-28783
5. Craft knowledge base: Securing Craft
6. CISA Known Exploited Vulnerabilities Catalog
7. FIRST EPSS overview
8. Censys advisory for prior Craft CMS exposure context