CVE-2026-28783

Craft CMS applies a blocklist mechanism to filter potentially dangerous PHP functions that can be invoked through non-Closure arrow functions in the Twig template engine. The vulnerability lies in the fact that the blocklist is incomplete — some PHP functions were not included on the forbidden list. An attacker with access to the admin panel (e.g., with the allowAdminChanges option enabled in a production environment, a compromised admin account, or access to the System Messages tool) can construct an appropriate payload in a Twig template and invoke the omitted PHP functions. The vulnerability affects both the 5.x and 4.x branches of the Craft CMS system.

An attacker with the required permissions can execute arbitrary code on the server side (RCE), read arbitrary system files, conduct SSRF or SSTI attacks, which could ultimately lead to complete system takeover and data compromise.

Craft CMS should be updated to version 5.9.0-beta.1 or 4.17.0-beta.1. Additionally, if not necessary, it is recommended to disable the allowAdminChanges option in production environments and restrict the number of accounts with access to the System Messages tool and admin panel.

Craft CMS in versions prior to 5.9.0-beta.1 and 4.17.0-beta.1