CVE-2026-28783 is a critical (CVSS 9.1) flaw in Craft CMS. Its blocklist for dangerous PHP functions in Twig arrow functions is incomplete. Craft 4.17.0 and 5.9.0 remove the blocklist and add the enableTwigSandbox setting. Upgrade, then switch that setting on in existing projects.
What's affected
The GitHub advisory lists the Composer package craftcms/cms from 4.0.0-RC1 up to before 4.17.0-beta.1, and from 5.0.0-RC1 up to before 5.9.0-beta.1. The advisory text names Craft 4.17.0 and 5.9.0 as the resolving releases.
Exploitation needs allowAdminChanges enabled on production, a compromised admin account, or an account with access to the System Messages utility.
How to check if you're exposed
Check the installed version:
composer show craftcms/cms
Then check your configuration for allowAdminChanges and enableTwigSandbox. The advisory says the sandbox setting is on by default only in new projects, so an older project must turn it on.
What to do now
- Upgrade
craftcms/cmsto 4.17.0 or later on 4.x, or 5.9.0 or later on 5.x. - Set
enableTwigSandboxto true in your general configuration for existing projects. - Keep
allowAdminChangesoff in production. - Review who can reach the System Messages utility and trim access.
- Audit email templates and system messages for unexpected Twig content.
Why it matters
The record lists CWE-1336 (template engine injection), CWE-184 (incomplete list of disallowed inputs) and CWE-94 (code injection). The core idea is that a blocklist only stops what its author thought of. Several PHP functions were missing, which the advisory says could allow code execution, file reads, server side request forgery and further template injection.
The advisory notes that Twig has deprecated this behavior. The vendor's fix is to remove the blocklist approach and turn off non-Closure arrow functions globally through the sandbox setting. That is the better design: deny the capability, not individual names.
The same release addresses CVE-2026-28697, so one upgrade covers both.
Quick check
Is upgrading enough?
Per the advisory, existing projects also need to enable the enableTwigSandbox setting, since it is on by default only for new projects.
Sources
Last reviewed: 19 October 2026.
