What is the CVSS score of CVE-2026-28784?

CVE-2026-28784 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Craft Cms are affected by CVE-2026-28784?

A high-severity remote code execution vulnerability exists in Craft CMS versions prior to 5.8.22 and 4.16.18, exploitable through malicious Twig payloads in administrative settings.. A patch is available.

How to fix or mitigate CVE-2026-28784?

Within 24 hours: Identify all Craft CMS instances and their versions; restrict administrative access to Settings and System Messages utilities to trusted personnel only. Within 7 days: Apply vendor patches to upgrade to Craft CMS 5.8.22 or 4.16.18 or later across all instances. Within 30 days: Conduct access audit of control panel modifications during the vulnerability window and validate system integrity.

Craft Cms CVE-2026-28784

HIGH

Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

2026-03-04 security-advisories@github.com

GHSA-qc86-q28f-ggww

RCE Craft Cms

7.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:05 vuln.today

Patch released

Mar 05, 2026 - 10:37 nvd

Patch available

CVE Published

Mar 04, 2026 - 17:16 nvd

HIGH 7.2

DescriptionGitHub Advisory

Craft is a content management system (CMS). Prior to 5.8.22 and 4.16.18, it is possible to craft a malicious payload using the Twig map filter in text fields that accept Twig input under Settings in the Craft control panel or using the System Messages utility, which could lead to a RCE. For this to work, you must have administrator access to the Craft Control Panel, and allowAdminChanges must be enabled for this to work, which is against our recommendations for any non-dev environment. Alternatively, you can have a non-administrator account with allowAdminChanges disabled, but you have access to the System Messages utility. Users should update to the patched versions (5.8.22 and 4.16.18) to mitigate the issue.

AnalysisAI

Remote code execution in Craft CMS versions before 5.8.22 and 4.16.18 can be achieved by authenticated administrators or users with System Messages access by injecting malicious Twig payloads through the map filter in configurable text fields. An attacker with admin-level privileges and allowAdminChanges enabled, or non-admin access to System Messages utilities, can execute arbitrary code on the affected server. A patch is available and users should update immediately to mitigate this risk.

Technical ContextAI

Affects Craft Cms. Craft is a content management system (CMS). Prior to 5.8.22 and 4.16.18, it is possible to craft a malicious payload using the Twig map filter in text fields that accept Twig input under Settings in the Craft control panel or using the System Messages utility, which could lead to a RCE. For this to work, you must have administrator access to the Craft Control Panel, and allowAdminChanges must be enabled for this to work, which is against our recommendations for any non-dev environment. Alternati