RCE in Craftcms Cms
CVE-2026-28783
Craft is a content management system (CMS). Prior to 5.9.0-beta.1 and 4.17.0-beta.1, Craft CMS implements a blocklist to prevent potentially dangerous PHP functions from being called via Twig non-Closure arrow functions. In order to be able to successfully execute this attack, you need to either have allowAdminChanges enabled on production, or a compromised admin account, or an account with access to the System Messages utility. Several PHP functions are not included in the blocklist, which could allow malicious actors with the required permissions to execute various types of payloads, including RCEs, arbitrary file reads, SSRFs, and SSTIs. This vulnerability is fixed in 5.9.0-beta.1 and 4.17.0-beta.1.
Vulnerability class: RCE (Remote Code Execution)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.005 (43.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 44th percentile — 43.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: +0.001
Affected products
- Craftcms Cms — versions >= 5.0.0-RC1, <= 5.9.0-beta.1, >= 4.0.0-RC1, <= 4.17.0-beta.1
- Craftcms Craft Cms — versions 4.0.0, 5.0.0
Weakness classification (CWE)
References
- github.com/craftcms/cms/security/advisories/GHSA-5fvc-7894-ghp4 (Patch, Vendor Advisory)
- github.com/craftcms/cms/pull/18208 (Patch, Issue Tracking)
Frequently asked questions
- What is CVE-2026-28783?
- CVE-2026-28783 is a critical-severity vulnerability in Craftcms Cms, classified under Code Injection. CVSS score: 9.1/10. Published 2026-03-04.
- How severe is CVE-2026-28783?
- Critical severity. CVSS v3 base score is 9.1 out of 10.