CVE-2026-28784Disclosure(craftcms / craft_cms)

LOWCVSS 7.2 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Craft is a content management system (CMS). Prior to 5.8.22 and 4.16.18, it is possible to craft a malicious payload using the Twig map filter in text fields that accept Twig input under Settings in the Craft control panel or using the System Messages utility, which could lead to a RCE. For this to work, you must have administrator access to the Craft Control Panel, and allowAdminChanges must be enabled for this to work, which is against our recommendations for any non-dev environment. Alternatively, you can have a non-administrator account with allowAdminChanges disabled, but you have access to the System Messages utility. Users should update to the patched versions (5.8.22 and 4.16.18) to mitigate the issue.

craftcms CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

Other references

https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production

Weakness type (CWE)

CWE-1336

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

craft_cms

Threat summary

1 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Affected systems

Vendors

craftcms

Products

craft_cms

2 versions affected across 1 product

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets1 URL

By indicator

https://www.cve.org/CVERecord?id=CVE-2026-28784

Full discourse1 post

CVE@CVEnew217d
Disclosure
CVE-2026-28784 Craft is a content management system (CMS). Prior to 5.8.22 and 4.16.18, it is possible to craft a malicious payload using the Twig map filter in text fields that acc… https://www.cve.org/CVERecord?id=CVE-2026-28784
Post summary
The tweet announces a vulnerability in Craft CMS versions prior to 5.8.22 and 4.16.18, noting the possibility of crafting malicious payloads using the Twig map filter, but gives no PoC, patch, or exploitation details.
00000130
56.6K followersView on X

CPE platform detail7 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

7 of 7 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	craftcms	craft_cms	-	-	-
App	craftcms	craft_cms	4.0.0	-	-
App	craftcms	craft_cms	4.0.0	-	-
App	craftcms	craft_cms	4.0.0	-	-
App	craftcms	craft_cms	4.0.0	-	-
App	craftcms	craft_cms	5.0.0	-	-
App	craftcms	craft_cms	5.0.0	-	-

Explore more

Back to dashboard craftcms CVEs craft_cms vulnerabilities