7.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-28695

CVE-2026-28695: Craft affected by authenticated RCE via Twig SSTI - create() function + Symfony Process gadget

Craft is a content management system (CMS). There is an authenticated admin RCE in Craft CMS 5.8.21 via Server-Side Template Injection using the create() Twig function combined with a Symfony Process gadget chain. The create() Twig function exposes Craft::createObject(), which allows instantiation of arbitrary PHP classes with constructor arguments. Combined with the bundled symfony/process dependency, this enables RCE. This bypasses the fix implemented for CVE-2025-57811 (patched in 5.8.7). This vulnerability is fixed in 5.9.0-beta.1 and 4.17.0-beta.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-28695

CVE-2026-28695:

7.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
craftcms/cms	composer	>= 5.8.7, < 5.9.0-beta.1	5.9.0-beta.1
craftcms/cms	composer	>= 4.0.0-RC1, < 4.17.0-beta.1	4.17.0-beta.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in an insecure Server-Side Template Injection (SSTI) vector within Craft CMS. The create() function available in Twig templates was a direct alias for the powerful craft\Craft::createObject method. This method is capable of instantiating any PHP class available in the application's scope. The patch analysis confirms this was the root cause. The fix involves removing the direct mapping and introducing an intermediary function, craft\web\twig\Extension::createFunction. This new function serves as a security control, validating that any class requested for instantiation through the create() Twig function must be a child of yii\\base\\BaseObject. The vulnerability was exploited by passing Symfony\\Component\\Process\\Process to this function, which is not a subclass of BaseObject, to achieve remote code execution. Therefore, during exploitation on a vulnerable system, the craft\Craft::createObject function would be the key indicator in a runtime profile, as it's the function that directly handles the instantiation of the malicious Process object.

Vulnerable functions

craft\Craft::createObject

src/Craft.php

The `create()` Twig function was directly mapped to `craft\Craft::createObject`, which can instantiate arbitrary PHP classes. An authenticated attacker could exploit this by crafting a template that calls `create()` with `Symfony\\Component\\Process\\Process` as the class name, allowing them to execute arbitrary shell commands on the server. The function `createObject` is the one that performs the dangerous instantiation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.