What is the CVSS score of CVE-2026-28695?

CVE-2026-28695 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-28695?

Craft CMS installations running version 5.8.21 are vulnerable to remote code execution attacks by authenticated administrators, allowing attackers with admin access to execute arbitrary commands on…. A patch is available.

Is there a public PoC exploit available for CVE-2026-28695?

Yes, a public proof-of-concept exploit is available for CVE-2026-28695. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-28695?

Within 24 hours: Identify all Craft CMS 5.8.21 instances in your environment and restrict admin portal access to trusted IP ranges. Within 7 days: Apply the available vendor patch to all affected systems and verify successful deployment. Within 30 days: Conduct access reviews of all CMS administrator accounts and implement multi-factor authentication for admin logins.

PHP CVE-2026-28695

HIGH

Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

2026-03-04 security-advisories@github.com

GHSA-94rc-cqvm-m4pw

PHP RCE Craft Cms

7.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:05 vuln.today

PoC Detected

Mar 05, 2026 - 19:54 vuln.today

Public exploit code

Patch released

Mar 05, 2026 - 19:54 nvd

Patch available

CVE Published

Mar 04, 2026 - 17:16 nvd

HIGH 7.2

DescriptionGitHub Advisory

Craft is a content management system (CMS). There is an authenticated admin RCE in Craft CMS 5.8.21 via Server-Side Template Injection using the create() Twig function combined with a Symfony Process gadget chain. The create() Twig function exposes Craft::createObject(), which allows instantiation of arbitrary PHP classes with constructor arguments. Combined with the bundled symfony/process dependency, this enables RCE. This bypasses the fix implemented for CVE-2025-57811 (patched in 5.8.7). This vulnerability is fixed in 5.9.0-beta.1 and 4.17.0-beta.1.

AnalysisAI

Remote code execution in Craft CMS 5.8.21 allows authenticated administrators to execute arbitrary PHP code through Server-Side Template Injection in the create() Twig function combined with Symfony Process gadget chains. Public exploit code exists for this vulnerability, which bypasses the previous patch for CVE-2025-57811. Updates are available in Craft CMS 5.9.0-beta.1 and 4.17.0-beta.1.

Technical ContextAI

Affects Craft Cms. Craft is a content management system (CMS). There is an authenticated admin RCE in Craft CMS 5.8.21 via Server-Side Template Injection using the create() Twig function combined with a Symfony Process gadget chain. The create() Twig function exposes Craft::createObject(), which allows instantiation of arbitrary PHP classes with constructor arguments. Combined with the bundled symfony/process dependency, this enables RCE. This bypasses the fix implemented for CVE-2025-57811 (patched in 5.8.7). Thi