Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Craft is a content management system (CMS). Prior to 5.9.0-beta.1 and 4.17.0-beta.1, Craft CMS implements a blocklist to prevent potentially dangerous PHP functions from being called via Twig non-Closure arrow functions. In order to be able to successfully execute this attack, you need to either have allowAdminChanges enabled on production, or a compromised admin account, or an account with access to the System Messages utility. Several PHP functions are not included in the blocklist, which could allow malicious actors with the required permissions to execute various types of payloads, including RCEs, arbitrary file reads, SSRFs, and SSTIs. This vulnerability is fixed in 5.9.0-beta.1 and 4.17.0-beta.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 1 product
CVE-2026-28783 Craft is a content management system (CMS). Prior to 5.9.0-beta.1 and 4.17.0-beta.1, Craft CMS implements a blocklist to prevent potentially dangerous PHP functions f… https://www.cve.org/CVERecord?id=CVE-2026-28783
Post summary
The passage describes CVE‑2026‑28783, noting a blocklist flaw in Craft CMS and indicating that versions 5.9.0‑beta.1 and 4.17.0‑beta.1 include a fix.
7 of 7 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | craftcms | craft_cms | - | - | - |
| App | craftcms | craft_cms | 4.0.0 | - | - |
| App | craftcms | craft_cms | 4.0.0 | - | - |
| App | craftcms | craft_cms | 4.0.0 | - | - |
| App | craftcms | craft_cms | 4.0.0 | - | - |
| App | craftcms | craft_cms | 5.0.0 | - | - |
| App | craftcms | craft_cms | 5.0.0 | - | - |