Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.1
Craft CMS allows malicious code execution via Twig functions
CVE-2026-28783
GHSA-5fvc-7894-ghp4
Summary
Craft CMS has a security weakness that could allow hackers to execute malicious code on your website. This happens when an attacker has administrative access or high-level permissions. To fix this, update to Craft 4.17.0 or 5.9.0, and make sure the 'enableTwigSandbox' configuration setting is enabled. This setting is already enabled by default in new projects, so only existing projects need to update their settings.
What to do
- Update craftcms cms to version 5.9.0-beta.1.
- Update craftcms cms to version 4.17.0-beta.1.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| craftcms | cms | > 5.0.0-RC1 , <= 5.9.0-beta.1 | 5.9.0-beta.1 |
| craftcms | cms | > 4.0.0-RC1 , <= 4.17.0-beta.1 | 4.17.0-beta.1 |
| craftcms | craft_cms | > 4.0.0 , <= 4.17.0 | – |
| craftcms | craft_cms | > 5.0.0 , <= 5.9.0 | – |
| craftcms | craft_cms | 4.0.0 | – |
| craftcms | craft_cms | 4.0.0 | – |
| craftcms | craft_cms | 4.0.0 | – |
| craftcms | craft_cms | 4.0.0 | – |
| craftcms | craft_cms | 5.0.0 | – |
| craftcms | craft_cms | 5.0.0 | – |
Original title
Craft CMS has Twig Function Blocklist Bypass
Original description
Craft CMS implements a blocklist to prevent potentially dangerous PHP functions from being called via Twig non-Closure arrow functions.
In order to be able to successfully execute this attack, you need to either have `allowAdminChanges` enabled on production, or a compromised admin account, or an account with access to the System Messages utility.
Several PHP functions are not included in the blocklist, which could allow malicious actors with the required permissions to execute various types of payloads, including RCEs, arbitrary file reads, SSRFs, and SSTIs.
Twig has already deprecated this behavior, and it will eventually be removed from Twig altogether.
https://github.com/twigphp/Twig/blob/946ddeafa3c9f4ce279d1f34051af041db0e16f2/src/Extension/CoreExtension.php#L2096
This has been resolved in Craft 4.17.0 and 5.9.0, which removes the blocklist and disables all non-Clousure arrow functions in Twig globally via the `enableTwigSandbox` config setting. That setting is enabled by default on all new Craft projects. Existing Craft projects will need to enable the config setting to take advantage of it.
Existing projects should update to the patched versions of 5.9.0 and 4.17.0 to mitigate the issue and enable the config setting.
## Resources
https://github.com/craftcms/cms/pull/18208
In order to be able to successfully execute this attack, you need to either have `allowAdminChanges` enabled on production, or a compromised admin account, or an account with access to the System Messages utility.
Several PHP functions are not included in the blocklist, which could allow malicious actors with the required permissions to execute various types of payloads, including RCEs, arbitrary file reads, SSRFs, and SSTIs.
Twig has already deprecated this behavior, and it will eventually be removed from Twig altogether.
https://github.com/twigphp/Twig/blob/946ddeafa3c9f4ce279d1f34051af041db0e16f2/src/Extension/CoreExtension.php#L2096
This has been resolved in Craft 4.17.0 and 5.9.0, which removes the blocklist and disables all non-Clousure arrow functions in Twig globally via the `enableTwigSandbox` config setting. That setting is enabled by default on all new Craft projects. Existing Craft projects will need to enable the config setting to take advantage of it.
Existing projects should update to the patched versions of 5.9.0 and 4.17.0 to mitigate the issue and enable the config setting.
## Resources
https://github.com/craftcms/cms/pull/18208
nvd CVSS3.1
9.1
nvd CVSS4.0
9.4
Vulnerability type
CWE-94
Code Injection
CWE-184
CWE-1336
- https://github.com/twigphp/Twig/blob/946ddeafa3c9f4ce279d1f34051af041db0e16f2/sr...
- https://nvd.nist.gov/vuln/detail/CVE-2026-28783
- https://github.com/advisories/GHSA-5fvc-7894-ghp4
- https://github.com/craftcms/cms/pull/18208 Issue Tracking Patch
- https://github.com/craftcms/cms/security/advisories/GHSA-5fvc-7894-ghp4 Vendor Advisory Patch
Published: 3 Mar 2026 · Updated: 13 Mar 2026 · First seen: 6 Mar 2026