CVE-2026-28695 Craft affected by authenticated RCE via Twig SSTI - create() function + Symfony Process gadget
Authenticated administrators can achieve remote code execution in Craft CMS via Server-Side Template Injection using the create() function and Symfony Process gadget.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-28695?
CVE-2026-28695 is a high-severity code injection vulnerability in Craftcms Craft Cms, published on 4 Mar 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Craft is a content management system (CMS). There is an authenticated admin RCE in Craft CMS 5.8.21 via Server-Side Template Injection using the create() Twig function combined with a Symfony Process gadget chain. The create() Twig function exposes Craft::createObject(), which allows instantiation of arbitrary PHP classes with constructor arguments. Combined with the bundled symfony/process dependency, this enables RCE. This bypasses the fix implemented for CVE-2025-57811 (patched in 5.8.7). This vulnerability is fixed in 5.9.0-beta.1 and 4.17.0-beta.1.
Weakness: CWE-1336
Which versions are affected by CVE-2026-28695?
4 open source packages ship an affected version, including craftcms/cms. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
craftcms/cms Packagist | From 4.0.0-RC1 | 4.17.0-beta.1 |
craftcms/cms Packagist | From 4.0.0-RC1 | 4.17.0-beta.1 |
craftcms/cms Packagist | From 5.8.7 | 5.9.0-beta.1 |
craftcms/cms Packagist | From 5.8.7 | 5.9.0-beta.1 |
Products include Craftcms Craft Cms.
How do I fix CVE-2026-28695?
Upgrade craftcms/cms to a fixed version for your release line: 4.17.0-beta.1 or 5.9.0-beta.1.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-28695 being exploited?
There is no known exploitation of CVE-2026-28695 in the wild and no public exploit code.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in Craftcms Craft Cms
Sources
Also known as GHSA-94rc-cqvm-m4pw.