8.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-28784

CVE-2026-28784: Craft CMS has potential authenticated Remote Code Execution via Twig SSTI

For this to work, the attacker must have administrator access to the Craft Control Panel, and allowAdminChanges must be enabled, which is against Craft CMS' recommendations for any non-dev environment.

https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production

Alternatively, they can have a non-administrator account with allowAdminChanges disabled, but they must have access to the System Messages utility.

It is possible to craft a malicious payload using the Twig map filter in text fields that accept Twig input under Settings in the Craft control panel or using the System Messages utility, which could lead to a RCE.

Users should update to the patched versions (5.8.22 and 4.16.18) to mitigate the issue.

References:

https://github.com/craftcms/cms/pull/18208

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-28784

CVE-2026-28784:

8.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
craftcms/cms	composer	>= 5.0.0-RC1, < 5.9.0-beta.1	5.9.0-beta.1
craftcms/cms	composer	>= 4.0.0-RC1, < 4.17.0-beta.1	4.17.0-beta.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Template Injection (SSTI) in Craft CMS, allowing an authenticated attacker to achieve Remote Code Execution. The root cause was the insecure configuration of the Twig template engine, which did not enable sandboxing.

An attacker could exploit this by supplying a malicious payload to any feature that renders Twig templates, such as the System Messages utility. The payload would use a Twig filter like map and pass a string representing a dangerous PHP function (e.g., 'system') as an 'arrow function'. Without sandboxing, Twig would execute this string as a function.

The developers had attempted a partial fix via a checkArrowFunction method, which used a denylist to block known dangerous functions. However, this approach was insufficient and could be bypassed.

The patch addresses the vulnerability by introducing a enableTwigSandbox setting. When enabled, the craft\web\View::createTwig method configures the Twig environment with the SandboxExtension. This extension, even with a permissive policy, inherently prevents non-Closure values (like strings) from being executed as functions, effectively closing the RCE vector. The flawed checkArrowFunction was consequently removed.

The identified vulnerable functions are therefore the checkArrowFunction itself, the various Twig filter implementations (mapFilter, filterFilter, etc.) that used it, and the createTwig method that set up the insecure environment.

Vulnerable functions

craft\web\twig\Extension::checkArrowFunction

src/web/twig/Extension.php

This function was a flawed security control that used an incomplete denylist to block dangerous functions from being used as arrow functions in Twig filters. An attacker could bypass this denylist to achieve remote code execution. The function was removed entirely in the patch.

craft\web\twig\Extension::mapFilter

src/web/twig/Extension.php

This function, which implements the 'map' filter, was vulnerable because it passed a user-controllable argument (`$arrow`) to the flawed `checkArrowFunction`. An attacker could provide a malicious function name as a string to this filter, leading to RCE. The vulnerability advisory specifically mentions the `map` filter.

craft\web\twig\Extension::filterFilter

src/web/twig/Extension.php

Similar to `mapFilter`, this function was vulnerable as it used the inadequate `checkArrowFunction` to validate the arrow function provided by the user, creating a vector for SSTI and RCE.

craft\web\twig\Extension::sortFilter

src/web/twig/Extension.php

This function, implementing the 'sort' filter, was vulnerable as it used the inadequate `checkArrowFunction` to validate the arrow function provided by the user, creating a vector for SSTI and RCE.

craft\web\twig\Extension::reduceFilter

src/web/twig/Extension.php

This function, implementing the 'reduce' filter, was vulnerable as it used the inadequate `checkArrowFunction` to validate the arrow function provided by the user, creating a vector for SSTI and RCE.

craft\web\View::createTwig

src/web/View.php

This function is responsible for creating and configuring the Twig environment. The vulnerability existed because this function did not enable Twig's sandbox mode, which would have prevented string literals from being treated as callable functions. The patch adds the `SandboxExtension` here to mitigate the issue at its root.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.