CVE-2026-28783

描述

Craft CMS implements a blocklist to prevent potentially dangerous PHP functions from being called via Twig non-Closure arrow functions. In order to be able to successfully execute this attack, you need to either have `allowAdminChanges` enabled on production, or a compromised admin account, or an account with access to the System Messages utility. Several PHP functions are not included in the blocklist, which could allow malicious actors with the required permissions to execute various types of payloads, including RCEs, arbitrary file reads, SSRFs, and SSTIs. Twig has already deprecated this behavior, and it will eventually be removed from Twig altogether. https://github.com/twigphp/Twig/blob/946ddeafa3c9f4ce279d1f34051af041db0e16f2/src/Extension/CoreExtension.php#L2096 This has been resolved in Craft 4.17.0 and 5.9.0, which removes the blocklist and disables all non-Clousure arrow functions in Twig globally via the `enableTwigSandbox` config setting. That setting is enabled by default on all new Craft projects. Existing Craft projects will need to enable the config setting to take advantage of it. Existing projects should update to the patched versions of 5.9.0 and 4.17.0 to mitigate the issue and enable the config setting. ## Resources https://github.com/craftcms/cms/pull/18208

如何修補 CVE-2026-28783

要修補 CVE-2026-28783,請將受影響套件升級到下列已修補版本。

• —升級至 5.9.0-beta.1 或更新版本

CVE-2026-28783 正在被利用嗎?

低 — EPSS 為 0.0%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• >= 5.0.0-RC1, < 5.9.0-beta.1

CVSS 分數

參考連結(5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2026-28783
• PATCHgithub.com/craftcms/cms
• WEBgithub.com/craftcms/cms/pull/18208
• WEBgithub.com/craftcms/cms/security/advisories/GHSA-5fvc-7894-ghp4