PT-2026-25802 · Craft Cms+1 · Craft Cms+1

Neosprings · Published 2026-03-16 · Updated 2026-03-17 · CVE-2026-32261

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Webhooks for Craft CMS plugin versions 3.0.0 through 3.1.9

Description The Webhooks plugin for Craft CMS allows management of webhooks, which send GET or POST requests upon specific events. Versions 3.0.0 through 3.1.9 render user-supplied template content using Twig’s renderString() function without sandbox protection. This enables an authenticated user with access to the Craft control panel and permissions to access the Webhooks plugin to inject Twig template code capable of calling arbitrary PHP functions. This is possible even if allowAdminChanges is set to false. The issue involves Server-Side Template Injection (SSTI).

Recommendations Update to version 3.2.0 or later to resolve the issue.

Exploit

Fix

RCE

Weakness Enumeration

CWE-1336

Related Identifiers

CVE-2026-32261

GHSA-8WG7-WM29-2RVG

Affected Products

Craft Cms

Webhooks For Craft Cms

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32261.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-32261 · Security Note
• https://osv.dev/vulnerability/GHSA-8wg7-wm29-2rvg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32261 · Vendor Advisory
• https://github.com/craftcms/webhooks/commit/88344991a68b07145567c46dfd0ae3328c521f62 · Note
• https://github.com/craftcms/webhooks/security/advisories/GHSA-8wg7-wm29-2rvg · Note
• https://github.com/craftcms/webhooks · Note
• https://twitter.com/cyberbivash/status/2033645434606965152 · Twitter Post
• https://twitter.com/CVEnew/status/2033755331319255205 · Twitter Post