→

CVE-2026-28783: Craft has a Twig Function Blocklist Bypass

Craft is a content management system (CMS). Prior to 5.9.0-beta.1 and 4.17.0-beta.1, Craft CMS implements a blocklist to prevent potentially dangerous PHP functions from being called via Twig non-Closure arrow functions. In order to be able to successfully execute this attack, you need to either have allowAdminChanges enabled on production, or a compromised admin account, or an account with access to the System Messages utility. Several PHP functions are not included in the blocklist, which could allow malicious actors with the required permissions to execute various types of payloads, including RCEs, arbitrary file reads, SSRFs, and SSTIs. This vulnerability is fixed in 5.9.0-beta.1 and 4.17.0-beta.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-28783

CVE-2026-28783:

9.4

CVSS Score

4.0

-

CVSS Score

-

Basic Information

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
craftcms/cms	composer	>= 5.0.0-RC1, < 5.9.0-beta.1	5.9.0-beta.1
craftcms/cms	composer	>= 4.0.0-RC1, < 4.17.0-beta.1	4.17.0-beta.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability existed in Craft CMS's handling of Twig's non-Closure arrow functions. To prevent code execution, Craft CMS implemented a custom function, checkArrowFunction, which maintained a blocklist of dangerous PHP functions (e.g., system, exec). However, this blocklist was incomplete, allowing an attacker with admin or template-editing permissions to call other dangerous, unlisted PHP functions (like phpinfo, var_dump, or other functions that could lead to file disclosure or SSRF) through various Twig filters such as map, filter, and sort.

The patch addresses this vulnerability at its root. Instead of relying on an imperfect blocklist, the fix removes the checkArrowFunction entirely. It introduces a new configuration setting, enableTwigSandbox, which, when enabled, activates Twig's Sandbox extension. A key side effect of enabling the sandbox, even with a permissive policy, is that it disables the use of string-based function names in arrow functions, which was the vector for the attack. This effectively forces developers to use safe, anonymous (Closure) functions, mitigating the risk of arbitrary code execution. The vulnerable functions are the various Twig filters in craft\web\twig\Extension that previously relied on the faulty checkArrowFunction for security.

Vulnerable functions

craft\web\twig\Extension::checkArrowFunction

src/web/twig/Extension.php

This function, which has been removed in the patch, contained an insufficient blocklist of dangerous functions. An attacker could bypass this blocklist by using other dangerous PHP functions not included in this list, leading to code execution or other malicious activities when passed as an arrow function to various Twig filters.

craft\web\twig\Extension::arraySome

src/web/twig/Extension.php

This function was vulnerable because it used the flawed `checkArrowFunction` to validate the `$arrow` parameter. An attacker could provide a malicious payload as the arrow function, bypassing the blocklist and leading to arbitrary code execution.

craft\web\twig\Extension::arrayEvery

src/web/twig/Extension.php

This function was vulnerable because it used the flawed `checkArrowFunction` to validate the `$arrow` parameter. An attacker could provide a malicious payload as the arrow function, bypassing the blocklist and leading to arbitrary code execution.

craft\web\twig\Extension::sortFilter

src/web/twig/Extension.php