CVE-2026-28784
HIGH EPSS 39.9%
Published Mar 4, 20263mo ago · Modified Jun 17, 20262w ago
8.6 CVSS 4.0
Published Mar 4, 2026 3mo ago
Last Modified Jun 17, 2026 2w ago
Description
Craft is a content management system (CMS). Prior to 5.8.22 and 4.16.18, it is possible to craft a malicious payload using the Twig map filter in text fields that accept Twig input under Settings in the Craft control panel or using the System Messages utility, which could lead to a RCE. For this to work, you must have administrator access to the Craft Control Panel, and allowAdminChanges must be enabled for this to work, which is against our recommendations for any non-dev environment. Alternatively, you can have a non-administrator account with allowAdminChanges disabled, but you have access to the System Messages utility. Users should update to the patched versions (5.8.22 and 4.16.18) to mitigate the issue.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Attack Vector Network
Attack Complexity Low
Privileges Required High
User Interaction None
Scope X
Threat Intelligence
EPSS Exploit Probability
39.9% percentile
Exploit & Patch Status
No Known Exploit
Patch Available
Weaknesses 1
CWE-1336
Affected Products 8
References 3
- craftcms.com https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production
- github.com https://github.com/craftcms/cms/pull/18208
- github.com https://github.com/craftcms/cms/security/advisories/GHSA-qc86-q28f-ggww
Remediation
- github.com https://github.com/craftcms/cms/pull/18208
- github.com https://github.com/craftcms/cms/security/advisories/GHSA-qc86-q28f-ggww