Craft CMS Vulnerable to Authenticated RCE via Twig SSTI - create() function + Symfony Process gadget
Packagist craftcms/cms · Upgrade to 5.9.0-beta.1 (pre-release) or 4.17.0-beta.1 (pre-release) by release line · >= 5.8.7, < 5.9.0-beta.1; >= 4.0.0-RC1, < 4.17.0-beta.1 · CVE-2026-28695 · GHSA-94rc-cqvm-m4pw