CVE-2026-28697 is a critical (CVSS 9.1) flaw in Craft CMS. An authenticated administrator can reach remote code execution through template injection in Twig fields such as email templates. It is fixed in 4.17.0-beta.1 and 5.9.0-beta.1. Upgrade and review who holds admin access.
What's affected
The GitHub advisory lists the Composer package craftcms/cms as affected from 4.0.0-RC1 up to before 4.17.0-beta.1, and from 5.0.0-RC1 up to before 5.9.0-beta.1. Fixed versions are 4.17.0-beta.1 and 5.9.0-beta.1.
The advisory says exploitation needs an administrator account with allowAdminChanges enabled, or access to the System Messages utility.
How to check if you're exposed
Check the installed Craft version from the project root:
composer show craftcms/cms
Also check your configuration for allowAdminChanges. The advisory notes it should not be on in production. List who holds admin accounts and who can reach System Messages.
What to do now
- Upgrade
craftcms/cmsto 4.17.0 or later on the 4.x line, or 5.9.0 or later on the 5.x line, and note that the advisory names the beta releases as the first fixed versions. - Turn off
allowAdminChangesin production. - Review administrator accounts, remove unused ones and require multi-factor authentication for the rest.
- Check system messages and email templates for unexpected Twig expressions, and look in web-accessible directories for files you do not recognize.
Why it matters
The weakness is template injection, tracked in the record as CWE-1336: improper neutralization of special elements used in a template engine. When a template field is rendered with powerful objects in reach, text typed in a settings screen becomes a program.
Here the risk is an insider or a stolen admin session. The CVSS vector shows high privileges required, but a changed scope and high impact on all three areas. Admin accounts are a common target, so a bug that turns admin into server access raises the cost of a single phished credential.
A related Craft advisory, CVE-2026-28783, covers a bypass of the function blocklist for Twig. Fixing both means upgrading and enabling the sandbox setting.
Quick check
Is this exploitable without an admin account?
The advisory describes an authenticated administrator as the attacker. The risk grows if admin credentials are weak, shared or phished, so treat the upgrade as urgent anyway.
Sources
Last reviewed: 19 October 2026.
