What happened
Authenticated RCE in Craft CMS ≤ 5.9.8 via SSTI gadget bypass in element-search.
Affected versions
Unknown product: See original advisory Fixed: See vendor advisory.
Why it matters
This source correlation may provide earlier visibility while structured CVE metadata is still being updated.
Detection & mitigation
- Review the original advisory and validate affected versions.
- Apply vendor-provided updates or mitigations when available.
Public PoC references
RepositoryAuthorFirst seenReference
SploitusAuthenticated RCE in Craft CMS ≤ 5.9.8 via SSTI gadget bypass in element-search.gbuyssens2026-09-27T10:20:58VerifiedSploitusAuthenticated blind RCE in Craft CMS bypasses the CVE-2026-28695 create() restriction.predyy2026-09-27T18:29:02Verifiedgbuyssens/CVE-2026-28695-craft-rce-bypassAuthenticated RCE in Craft CMS ≤ 5.9.8 via SSTI gadget bypass in element-search.gbuyssens2026-09-27T10:20:58Verifiedpredyy/CVE-2026-28695Authenticated blind RCE in Craft CMS bypasses the CVE-2026-28695 create() restriction.predyy2026-09-27T18:29:02VerifiedSource timeline
Discovered through SploitusView source ↗
Record history
Record created from the first normalized source observation.
Metadata and source references refreshed.