CVE-2026-31857
published 2026-03-11CVE-2026-31857: Craft is a content management system (CMS). Prior to 5.9.9 and 4.17.4, a Remote Code Execution vulnerability exists in the Craft CMS 5 conditions system. The…
PriorityP260high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.66%
49.3th percentile
Craft is a content management system (CMS). Prior to 5.9.9 and 4.17.4, a Remote Code Execution vulnerability exists in the Craft CMS 5 conditions system. The BaseElementSelectConditionRule::getElementIds() method passes user-controlled string input through renderObjectTemplate() -- an unsandboxed Twig rendering function with escaping disabled. Any authenticated Control Panel user (including non-admin roles such as Author or Editor) can achieve full RCE by sending a crafted condition rule via standard element listing endpoints. This vulnerability requires no admin privileges, no special permissions beyond basic control panel access, and bypasses all production hardening settings (allowAdminChanges: false, devMode: false, enableTwigSandbox: true). Users should update to the patched 5.9.9 or 4.17.4 release to mitigate the issue.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| craftcms | cms | — | — |
| craftcms | cms | — | — |
| craftcms | cms | >= 4.0.0-RC1 < 4.18.2 | 4.18.2 |
| craftcms | cms | >= 4.0.0-beta.1 < 4.17.4 | 4.17.4 |
| craftcms | cms | >= 5.0.0-RC1 < 5.9.9 | 5.9.9 |
| craftcms | cms | >= 5.0.0-RC1 < 5.10.6 | 5.10.6 |
| craftcms | craft_cms | — | — |
| craftcms | craft_cms | — | — |
| craftcms | craft_cms | >= 4.0.0.1 < 4.17.4 | 4.17.4 |
| craftcms | craft_cms | >= 5.0.1 < 5.9.9 | 5.9.9 |
Detection & IOCsextracted from sources · hover to see the quote
- →Any authenticated Control Panel user can trigger RCE by sending a crafted condition rule via standard element listing endpoints — monitor for unexpected Twig template expressions (e.g., `{{`, `{%`) in condition rule parameters submitted to element listing endpoints ↗
- →The vulnerable code path is BaseElementSelectConditionRule::getElementIds() passing user input to renderObjectTemplate() — look for anomalous calls to renderObjectTemplate with user-supplied data in Craft CMS logs or stack traces ↗
- →The exploit bypasses allowAdminChanges: false, devMode: false, and enableTwigSandbox: true — do not rely on these production hardening settings as compensating controls for detection or prevention ↗
- ·enableTwigSandbox: true does NOT protect against this vulnerability — the renderObjectTemplate() function used in the vulnerable code path is unsandboxed and has escaping disabled, bypassing the sandbox setting entirely ↗
- ·No admin privileges are required — any authenticated Control Panel user including low-privilege roles (Author, Editor) can exploit this vulnerability ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.08.1HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
ghsa8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Craft CMS: Authenticated leak of secret environment variables
ghsa·2026-08-06·CVSS 8.8
CVE-2026-31857 [HIGH] CWE-668 Craft CMS: Authenticated leak of secret environment variables
Craft CMS: Authenticated leak of secret environment variables
Environment variables and secrets are interpolated into a Twig template even when the Twig sandbox is enabled, allowing them to be leaked by an authenticated attacker.
The Craft vulnerability [CVE-2026-31857](https://github.com/craftcms/cms/security/advisories/GHSA-fp5j-j7j4-mcxc) was only patched by applying sandboxed Twig templating. This theoretically protects Craft CMS against RCE attacks, provided the sandbox is enabled and secure, with no known bypasses.
However, the same request parameter `elementId,` which allows for sandboxed Twig templates to be rendered, also includes functionality that interpolates referenced environment variables. If the parameter includes a string of the form `${ENV_VAR}` then the string is repl
GHSA
CraftCMS has an RCE vulnerability via relational conditionals in the control panel
ghsa·2026-03-11
CVE-2026-31857 [HIGH] CWE-94 CraftCMS has an RCE vulnerability via relational conditionals in the control panel
CraftCMS has an RCE vulnerability via relational conditionals in the control panel
A Remote Code Execution vulnerability exists in the Craft CMS 5 conditions system.
The `BaseElementSelectConditionRule::getElementIds()` method passes user-controlled string input
through `renderObjectTemplate()` -- an unsandboxed Twig rendering function with escaping disabled.
Any authenticated Control Panel user (including non-admin roles such as Author or Editor) can achieve full
RCE by sending a crafted condition rule via standard element listing endpoints.
This vulnerability requires no admin privileges, no special permissions beyond basic control panel access, and
bypasses all production hardening settings (allowAdminChanges: false, devMode: false,
enableTwigSandbox: true).
Users should update to
OSV
CraftCMS has an RCE vulnerability via relational conditionals in the control panel
osv·2026-03-11
CVE-2026-31857 [HIGH] CraftCMS has an RCE vulnerability via relational conditionals in the control panel
CraftCMS has an RCE vulnerability via relational conditionals in the control panel
A Remote Code Execution vulnerability exists in the Craft CMS 5 conditions system.
The `BaseElementSelectConditionRule::getElementIds()` method passes user-controlled string input
through `renderObjectTemplate()` -- an unsandboxed Twig rendering function with escaping disabled.
Any authenticated Control Panel user (including non-admin roles such as Author or Editor) can achieve full
RCE by sending a crafted condition rule via standard element listing endpoints.
This vulnerability requires no admin privileges, no special permissions beyond basic control panel access, and
bypasses all production hardening settings (allowAdminChanges: false, devMode: false,
enableTwigSandbox: true).
Users should update to
No detection rules found.
No public exploits indexed.
2026-03-11
Published