Summary
Craft CMS Vulnerable to Authenticated RCE via Twig SSTI - create() function + Symfony Process gadget
There is an authenticated admin RCE in Craft CMS 5.8.21 via Server-Side Template Injection using the create() Twig function combined with a Symfony Process gadget chain.
This bypasses the fix implemented for CVE-2025-57811 (patched in 5.8.7).
Required Permissions
- Administrator permissions or access to System Messages utility
allowAdminChangesenabled in production (against our security recommendations) or access to System Messages utility
Vulnerability Details
The create() Twig function exposes Craft::createObject(), which allows instantiation of arbitrary PHP classes with constructor arguments. Combined with the bundled symfony/process dependency, this enables RCE.
Attack Vector
Admin panel → Settings → Entry Types → Title Format field
Proof of Concept Payload
{% set p = create("Symfony\\Component\\Process\\Process", [["id"]])
%}{{ p.mustRun.getOutput }}
Steps to Reproduce
- Log in as admin
- Navigate to Settings → Entry Types
- Edit any entry type’s "Title Format" field
- Insert the payload above
- Create/edit an entry of that type
- Command executes, output appears in entry title
Root Cause
Craft::createObject() allows the instantiation of any class, includingSymfony\Component\Process\Process, which executes shell commands.
Resources
https://github.com/craftcms/cms/commit/e31e50849ad71638e11ea55fbd1ed90ae8f8f6e0
Impact
- Authenticated Remote Code Execution
- Runs as web server user (root in default Docker setup)
- Full server compromise
Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files. Typical impact: unauthorized file read or write outside the intended directory.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
- Blocklist dangerous classes in createObject() when called from Twig
- Or remove/restrict the create() Twig function
- Or validate class names against an allowlist
Frequently Asked Questions
- What is CVE-2026-28695? CVE-2026-28695 is a medium-severity path traversal vulnerability in craftcms/cms (composer), affecting versions >= 5.8.7, < 5.9.0-beta.1. It is fixed in 5.9.0-beta.1, 4.17.0-beta.1. Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files.
- Which versions of craftcms/cms are affected by CVE-2026-28695? craftcms/cms (composer) versions >= 5.8.7, < 5.9.0-beta.1 is affected.
- Is there a fix for CVE-2026-28695? Yes. CVE-2026-28695 is fixed in 5.9.0-beta.1, 4.17.0-beta.1. Upgrade to this version or later.
- Is CVE-2026-28695 exploitable, and should I be worried? Whether CVE-2026-28695 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-28695 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-28695?
- Upgrade
craftcms/cmsto 5.9.0-beta.1 or later - Upgrade
craftcms/cmsto 4.17.0-beta.1 or later
- Upgrade