CRITICAL🇵🇱 Wersja polska

CVE-2026-28697

CVSS 9.4v4.0pub. 2026-03-04upd. 2026-03-05

Craft is a content management system (CMS). Prior to 4.17.0-beta.1 and 5.9.0-beta.1, an authenticated administrator can achieve Remote Code Execution (RCE) by injecting a Server-Side Template Injection (SSTI) payload into Twig template fields (e.g., Email Templates). By calling the craft.app.fs.write() method, an attacker can write a malicious PHP script to a web-accessible directory and subsequently access it via the browser to execute arbitrary system commands. This vulnerability is fixed in 4.17.0-beta.1 and 5.9.0-beta.1.

🇵🇱 Read Polish description →

🤖 AI Analysis

How it works

An attacker with administrator privileges injects a Server-Side Template Injection (SSTI) payload into fields supporting Twig templates (e.g., Email Templates). The attacker then uses the craft.app.fs.write() method to write a malicious PHP script to a directory accessible via the browser. After the file is written, the attacker calls it directly via HTTP, resulting in the execution of arbitrary system commands on the server.

Impact

An attacker can execute arbitrary system commands on the server, write files to accessible web directories, and potentially gain full control over the operating system and application data.

Mitigation & patch

Update Craft CMS to version 4.17.0-beta.1 or later (4.x branch) or to version 5.9.0-beta.1 or later (5.x branch). Patch details are available in the vendor's GitHub repository (pull requests #18216 and #18219 and advisory GHSA-v47q-jxvr-p68x).

Who is affected

Craft CMS in versions earlier than 4.17.0-beta.1 (4.x branch) and earlier than 5.9.0-beta.1 (5.x branch)

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X