CVE-2026-28695: Craft CMS Vulnerable to Authenticated RCE via Twig SSTI - create() function + Symfony Process gadget

March 3, 2026 (updated March 4, 2026)

There is an authenticated admin RCE in Craft CMS 5.8.21 via Server-Side Template Injection using the create() Twig function combined with a Symfony Process gadget chain.

This bypasses the fix implemented for CVE-2025-57811 (patched in 5.8.7).

References

github.com/advisories/GHSA-94rc-cqvm-m4pw
github.com/craftcms/cms
github.com/craftcms/cms/commit/e31e50849ad71638e11ea55fbd1ed90ae8f8f6e0
github.com/craftcms/cms/security/advisories/GHSA-94rc-cqvm-m4pw
nvd.nist.gov/vuln/detail/CVE-2026-28695

Code Behaviors & Features

Detect and mitigate CVE-2026-28695 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →