CVE-2026-28695 — Improper Neutralization of Special Elements Used in a Template Engine in Craft CMS
Severity
7.5HIGHNVD
CNA6.1GHSA6.1OSV6.1
EPSS
0.1%
top 77.64%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMar 4
Description
Craft is a content management system (CMS). There is an authenticated admin RCE in Craft CMS 5.8.21 via Server-Side Template Injection using the create() Twig function combined with a Symfony Process gadget chain. The create() Twig function exposes Craft::createObject(), which allows instantiation of arbitrary PHP classes with constructor arguments. Combined with the bundled symfony/process dependency, this enables RCE. This bypasses the fix implemented for CVE-2025-57811 (patched in 5.8.7). Thi…
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected Packages3 packages
Patches
🔴Vulnerability Details
3CVEList▶
Craft affected by authenticated RCE via Twig SSTI - create() function + Symfony Process gadget↗2026-03-04
GHSA▶
Craft CMS Vulnerable to Authenticated RCE via Twig SSTI - create() function + Symfony Process gadget↗2026-03-03
OSV▶
Craft CMS Vulnerable to Authenticated RCE via Twig SSTI - create() function + Symfony Process gadget↗2026-03-03