CVE-2026-28695 | Craft CMS Twig SSTI create path traversal

A vulnerability, which was classified as critical, has been found in Craft CMS. The impacted element is the function create of the component Twig SSTI. This manipulation causes path traversal.

This vulnerability is registered as CVE-2026-28695. Remote exploitation of the attack is possible. No exploit is available.

It is advisable to upgrade the affected component.