PT-2026-24751 · Craft Cms+2 · Cms+2
Neosprings
·
Publicado
2026-03-11
·
Atualizado
2026-03-12
·
CVE-2026-31857
CVSS v3.1
8.8
Alta
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Craft versions prior to 5.9.9
Craft versions prior to 4.17.4
Description
Craft is a content management system (CMS). A Remote Code Execution issue exists in the Craft CMS 5 conditions system. The
BaseElementSelectConditionRule::getElementIds() method passes user-controlled string input through renderObjectTemplate(), a Twig rendering function that lacks sandboxing and has escaping disabled. Any authenticated Control Panel user, including those with non-administrative roles like Author or Editor, can achieve full Remote Code Execution by sending a specially crafted condition rule through standard element listing endpoints. This issue does not require administrator privileges or special permissions beyond basic Control Panel access and bypasses all production hardening settings. The renderObjectTemplate() function is involved in the issue.Recommendations
Craft versions prior to 5.9.9 should be updated to version 5.9.9.
Craft versions prior to 4.17.4 should be updated to version 4.17.4.
Exploit
Correção
RCE
Code Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Cms
Craft Cms
Craftcms/Cms