Vulnerability · Published Mar 4, 2026 · Assigned by GitHub_M

CVE-2026-28697Craft Affected by Authenticated RCE via "craft.app.fs.write()" in Twig Templates

Critical 9.4

In plain English

A critical-severity security flaw in cms from craftcms. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)9.4Critical

Exploit odds (30 days)1.2%top 32.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Craft is a content management system (CMS). Prior to 4.17.0-beta.1 and 5.9.0-beta.1, an authenticated administrator can achieve Remote Code Execution (RCE) by injecting a Server-Side Template Injection (SSTI) payload into Twig template fields (e.g., Email Templates). By calling the craft.app.fs.write() method, an attacker can write a malicious PHP script to a web-accessible directory and subsequently access it via the browser to execute arbitrary system commands. This vulnerability is fixed in 4.17.0-beta.1 and 5.9.0-beta.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	craftcms/cms	5.9.0-beta.1	GHSA-v47q-jxvr-p68x
Packagist	craftcms/cms	4.17.0-beta.1	GHSA-v47q-jxvr-p68x

Affected products (as reported)

Vendor	Product	Versions
craftcms	cms	>= 5.0.0-RC1, < 5.9.0-beta.1>= 4.0.0-RC1, < 4.17.0-beta.1

Weakness: CWE-1336 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

https://github.com/craftcms/cms/security/advisories/GHSA-v47q-jxvr-p68x x_refsource_CONFIRM
https://github.com/craftcms/cms/pull/18216 x_refsource_MISC
https://github.com/craftcms/cms/pull/18219 x_refsource_MISC
https://github.com/craftcms/cms/commit/9dc2a4a3ec8e9cd5e8c0d1129f36371437519197 x_refsource_MISC