PT-2026-25802 · Craft Cms+1 · Craft Cms+1

Neosprings · Publicado 2026-03-16 · Atualizado 2026-03-17 · CVE-2026-32261

Positive Technologies (AI Summary)

CVSS v4.0

8.5

Alta

Vetor base

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Webhooks for Craft CMS plugin versions 3.0.0 through 3.1.9

Description The Webhooks plugin for Craft CMS allows management of webhooks, which send GET or POST requests upon specific events. Versions 3.0.0 through 3.1.9 render user-supplied template content using Twig’s renderString() function without sandbox protection. This enables an authenticated user with access to the Craft control panel and permissions to access the Webhooks plugin to inject Twig template code capable of calling arbitrary PHP functions. This is possible even if allowAdminChanges is set to false. The issue involves Server-Side Template Injection (SSTI).

Recommendations Update to version 3.2.0 or later to resolve the issue.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-1336

Identificadores relacionados

CVE-2026-32261

GHSA-8WG7-WM29-2RVG

Produtos afetados

Craft Cms

Webhooks For Craft Cms

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32261.json · Exploit
• https://github.com/craftcms/webhooks/commit/88344991a68b07145567c46dfd0ae3328c521f62 · Nota
• https://github.com/craftcms/webhooks/security/advisories/GHSA-8wg7-wm29-2rvg · Nota
• https://github.com/craftcms/webhooks · Nota
• https://twitter.com/cyberbivash/status/2033645434606965152 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2033755331319255205 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-32261 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-8wg7-wm29-2rvg · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-32261 · Aviso do Fabricante