Get a Demo

Let's Patch It!

Book a short call with one our specialists, we'll walk you through how Endor Patches work, and ask you a few questions about your environment (like your primary programming languages and repository management). We'll also send you an email right after you fill out the form, feel free to reply with any questions you have in advance!

CVE

CVE-2026-28695

Craft affected by authenticated RCE via Twig SSTI - create() function + Symfony Process gadget
Back to all
CVE

CVE-2026-28695

Craft affected by authenticated RCE via Twig SSTI - create() function + Symfony Process gadget

Craft is a content management system (CMS). There is an authenticated admin RCE in Craft CMS 5.8.21 via Server-Side Template Injection using the create() Twig function combined with a Symfony Process gadget chain. The create() Twig function exposes Craft::createObject(), which allows instantiation of arbitrary PHP classes with constructor arguments. Combined with the bundled symfony/process dependency, this enables RCE. This bypasses the fix implemented for CVE-2025-57811 (patched in 5.8.7). This vulnerability is fixed in 5.9.0-beta.1 and 4.17.0-beta.1.

Package Versions Affected

Package Version
patch Availability
No items found.

Automatically patch vulnerabilities without upgrading

Fix Without Upgrading
Detect compatible fix
Apply safe remediation
Fix with a single pull request

CVSS Version

Severity
Base Score
CVSS Version
Score Vector
C
H
U
7.5
-
4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
C
H
U
0
-
C
H
U
-

Related Resources

No items found.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28695.json, https://github.com/craftcms/cms/security/advisories/GHSA-94rc-cqvm-m4pw, https://nvd.nist.gov/vuln/detail/CVE-2026-28695, https://github.com/craftcms/cms/commit/e31e50849ad71638e11ea55fbd1ed90ae8f8f6e0

Severity

0

CVSS Score
0
10

Basic Information

Ecosystem
Base CVSS
0
EPSS Probability
0.00027%
EPSS Percentile
0.08212%
Introduced Version
79c68d9f00ece882c0e9c336e4545fef5f9b06a7,daac7c1da2f701f2e9ddee1da1457ce61660b581
Fix Available
0ad14c3c7e590461b52aeb44859659e2e231e04d,42cef196d68dd8d48ceaab89b2c9e2edd2cecbe8

Fix Critical Vulnerabilities Instantly

Secure your app without upgrading.
Fix Without Upgrading