Description
Craft is a content management system (CMS). There is an authenticated admin RCE in Craft CMS 5.8.21 via Server-Side Template Injection using the create() Twig function combined with a Symfony Process gadget chain. The create() Twig function exposes Craft::createObject(), which allows instantiation of arbitrary PHP classes with constructor arguments. Combined with the bundled symfony/process dependency, this enables RCE. This bypasses the fix implemented for CVE-2025-57811 (patched in 5.8.7). This vulnerability is fixed in 5.9.0-beta.1 and 4.17.0-beta.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| craftcms | cms | >= 5.8.7, < 5.9.0-beta.1, >= 4.0.0-RC1, < 4.17.0-beta.1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
predyy/CVE-2026-28695 ★ 5 · Sep 27, 2026
CVE-2026-28695 PoC - Authenticated blind remote code execution in Craft CMS.
-
gbuyssens/CVE-2026-28695-craft-rce-bypass ★ 1 · Sep 27, 2026
Authenticated, **blind** remote code execution in Craft CMS. Fix for CVE-2026-28695
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | craftcms/cms | >= 5.8.7, < 5.9.0-beta.1 | 5.9.0-beta.1 | GHSA-94rc-cqvm-m4pw |
| Packagist | craftcms/cms | >= 4.0.0-RC1, < 4.17.0-beta.1 | 4.17.0-beta.1 | GHSA-94rc-cqvm-m4pw |