PT-2026-24751 · Craft Cms+2 · Cms+2

Neosprings · Published 2026-03-11 · Updated 2026-03-12 · CVE-2026-31857

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Craft versions prior to 5.9.9 Craft versions prior to 4.17.4

Description Craft is a content management system (CMS). A Remote Code Execution issue exists in the Craft CMS 5 conditions system. The BaseElementSelectConditionRule::getElementIds() method passes user-controlled string input through renderObjectTemplate(), a Twig rendering function that lacks sandboxing and has escaping disabled. Any authenticated Control Panel user, including those with non-administrative roles like Author or Editor, can achieve full Remote Code Execution by sending a specially crafted condition rule through standard element listing endpoints. This issue does not require administrator privileges or special permissions beyond basic Control Panel access and bypasses all production hardening settings. The renderObjectTemplate() function is involved in the issue.

Recommendations Craft versions prior to 5.9.9 should be updated to version 5.9.9. Craft versions prior to 4.17.4 should be updated to version 4.17.4.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-31857

GHSA-FP5J-J7J4-MCXC

Affected Products

Cms

Craft Cms

Craftcms/Cms

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31857.json · Exploit
• https://github.com/craftcms/cms/commit/8d4903647dcfd31b8d40ed027e27082013347a80 · Patch
• https://github.com/craftcms/cms/security/advisories/GHSA-fp5j-j7j4-mcxc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31857 · Security Note
• https://osv.dev/vulnerability/CVE-2026-31857 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fp5j-j7j4-mcxc · Vendor Advisory
• https://github.com/craftcms/cms · Note
• https://t.me/CVEtracker/47160 · Telegram Post
• https://twitter.com/dailycve/status/2031907168790679776 · Twitter Post
• https://twitter.com/CVEnew/status/2031992402211451155 · Twitter Post