CVE-2026-28697 Craft Affected by Authenticated RCE via "craft.app.fs.write()" in Twig Templates

What is CVE-2026-28697?

CVE-2026-28697 is a critical code injection vulnerability in Craftcms Craft Cms, published on 4 Mar 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Craft is a content management system (CMS). Prior to 4.17.0-beta.1 and 5.9.0-beta.1, an authenticated administrator can achieve Remote Code Execution (RCE) by injecting a Server-Side Template Injection (SSTI) payload into Twig template fields (e.g., Email Templates). By calling the craft.app.fs.write() method, an attacker can write a malicious PHP script to a web-accessible directory and subsequently access it via the browser to execute arbitrary system commands. This vulnerability is fixed in 4.17.0-beta.1 and 5.9.0-beta.1.

Weakness: CWE-1336

Which versions are affected by CVE-2026-28697?

4 open source packages ship an affected version, including craftcms/cms. It affects 1 product.

Products include Craftcms Craft Cms.

How do I fix CVE-2026-28697?

Upgrade craftcms/cms to a fixed version for your release line: 4.17.0-beta.1 or 5.9.0-beta.1.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2026-28697 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-28697 exists.

Other vulnerabilities in Craftcms Craft Cms

• CVE-2025-32432 Craft CMS Code Injection Exploited Critical 10.0
• CVE-2024-56145 Craft CMS Code Injection Exploited Critical 9.3
• CVE-2025-23209 Craft CMS Code Injection Exploited High 8.1
• CVE-2025-35939 Craft CMS External Control of Assumed-Immutable Web Parameter Exploited Medium 6.9
• CVE-2023-41892 Craft CMS Remote Code Execution vulnerability Critical 10.0

All Craftcms Craft Cms vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-v47q-jxvr-p68x.