CVE-2026-31857: Craft is a content management system (CMS). Prior to 5.9.9 and 4.17.4, a Remote Code Execution vulnerability exists in the Craft CMS 5 conditions system. The…

PriorityP260high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

0.66%

47.1th percentile

Craft is a content management system (CMS). Prior to 5.9.9 and 4.17.4, a Remote Code Execution vulnerability exists in the Craft CMS 5 conditions system. The BaseElementSelectConditionRule::getElementIds() method passes user-controlled string input through renderObjectTemplate() -- an unsandboxed Twig rendering function with escaping disabled. Any authenticated Control Panel user (including non-admin roles such as Author or Editor) can achieve full RCE by sending a crafted condition rule via standard element listing endpoints. This vulnerability requires no admin privileges, no special permissions beyond basic control panel access, and bypasses all production hardening settings (allowAdminChanges: false, devMode: false, enableTwigSandbox: true). Users should update to the patched 5.9.9 or 4.17.4 release to mitigate the issue.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
craftcms	cms	—	—
craftcms	cms	—	—
craftcms	cms	>= 4.0.0-beta.1 < 4.17.4	4.17.4
craftcms	cms	>= 5.0.0-RC1 < 5.9.9	5.9.9
craftcms	craft_cms	—	—
craftcms	craft_cms	—	—
craftcms	craft_cms	>= 4.0.0.1 < 4.17.4	4.17.4
craftcms	craft_cms	>= 5.0.1 < 5.9.9	5.9.9

Detection & IOCsextracted from sources · hover to see the quote

→Any authenticated Control Panel user can trigger RCE by sending a crafted condition rule via standard element listing endpoints — monitor for unexpected Twig template expressions (e.g., `{{`, `{%`) in condition rule parameters submitted to element listing endpoints ↗
→The vulnerable code path is BaseElementSelectConditionRule::getElementIds() passing user input to renderObjectTemplate() — look for anomalous calls to renderObjectTemplate with user-supplied data in Craft CMS logs or stack traces ↗
→The exploit bypasses allowAdminChanges: false, devMode: false, and enableTwigSandbox: true — do not rely on these production hardening settings as compensating controls for detection or prevention ↗

·enableTwigSandbox: true does NOT protect against this vulnerability — the renderObjectTemplate() function used in the vulnerable code path is unsandboxed and has escaping disabled, bypassing the sandbox setting entirely ↗
·No admin privileges are required — any authenticated Control Panel user including low-privilege roles (Author, Editor) can exploit this vulnerability ↗

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv4.08.1HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.