Read the docs
TI-2026-24409 Aliases CVE-2026-31857GHSA-fp5j-j7j4-mcxc

CraftCMS has an RCE vulnerability via relational conditionals in the control panel

Priority MEDIUM 45CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.

Summary

Craft is a content management system (CMS). Prior to 5.9.9 and 4.17.4, a Remote Code Execution vulnerability exists in the Craft CMS 5 conditions system. The BaseElementSelectConditionRule::getElementIds() method passes user-controlled string input through renderObjectTemplate() -- an unsandboxed Twig rendering function with escaping disabled. Any authenticated Control Panel user (including non-admin roles such as Author or Editor) can achieve full RCE by sending a crafted condition rule via standard element listing endpoints. This vulnerability requires no admin privileges, no special permissions beyond basic control panel access, and bypasses all production hardening settings (allowAdminChanges: false, devMode: false, enableTwigSandbox: true). Users should update to the patched 5.9.9 or 4.17.4 release to mitigate the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00923 60th percentileScored 2026-11-07
Fix Fixed cms (craftcms): 5.9.9, 4.17.4craftcms/cms (Packagist): 5.9.9, 4.17.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Craft CMScms5.0.0-RC1 to before 5.9.9; 4.0.0-beta.1 to before 4.17.45.9.9, 4.17.4Patch availableCNA
—craftcms/cms (Packagist)5.0.0-RC1 to before 5.9.95.9.9Patch availableGHSA-fp5j-j7j4-mcxc
—craftcms/cms (Packagist)4.0.0-beta.1 to before 4.17.44.17.4Patch availableGHSA-fp5j-j7j4-mcxc
  • cms VendorCraft CMS Affected 5.0.0-RC1 to before 5.9.9; 4.0.0-beta.1 to before 4.17.4 Fixed in 5.9.9, 4.17.4 Patch available CNA
  • craftcms/cms (Packagist) Vendor— Affected 5.0.0-RC1 to before 5.9.9 Fixed in 5.9.9 Patch available GHSA-fp5j-j7j4-mcxc
  • craftcms/cms (Packagist) Vendor— Affected 4.0.0-beta.1 to before 4.17.4 Fixed in 4.17.4 Patch available GHSA-fp5j-j7j4-mcxc

CPE configurations NVD · 11

CPEVersionsRoleVendor
cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*4.0.0.1 to before 4.17.4; 5.0.1 to before 5.9.9VulnerableCraft CMS
cpe:2.3:a:craftcms:craft_cms:4.0.0:-:*:*:*:*:*:*4.0.0VulnerableCraft CMS
cpe:2.3:a:craftcms:craft_cms:4.0.0:beta1:*:*:*:*:*:*4.0.0 beta1VulnerableCraft CMS
cpe:2.3:a:craftcms:craft_cms:4.0.0:beta2:*:*:*:*:*:*4.0.0 beta2VulnerableCraft CMS
cpe:2.3:a:craftcms:craft_cms:4.0.0:beta3:*:*:*:*:*:*4.0.0 beta3VulnerableCraft CMS
cpe:2.3:a:craftcms:craft_cms:4.0.0:beta4:*:*:*:*:*:*4.0.0 beta4VulnerableCraft CMS
cpe:2.3:a:craftcms:craft_cms:4.0.0:rc1:*:*:*:*:*:*4.0.0 rc1VulnerableCraft CMS
cpe:2.3:a:craftcms:craft_cms:4.0.0:rc2:*:*:*:*:*:*4.0.0 rc2VulnerableCraft CMS
cpe:2.3:a:craftcms:craft_cms:4.0.0:rc3:*:*:*:*:*:*4.0.0 rc3VulnerableCraft CMS
cpe:2.3:a:craftcms:craft_cms:5.0.0:-:*:*:*:*:*:*5.0.0VulnerableCraft CMS
  • cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:* Versions 4.0.0.1 to before 4.17.4; 5.0.1 to before 5.9.9 Vulnerable ·Craft CMS
  • cpe:2.3:a:craftcms:craft_cms:4.0.0:-:*:*:*:*:*:* Versions 4.0.0 Vulnerable ·Craft CMS
  • cpe:2.3:a:craftcms:craft_cms:4.0.0:beta1:*:*:*:*:*:* Versions 4.0.0 beta1 Vulnerable ·Craft CMS
  • cpe:2.3:a:craftcms:craft_cms:4.0.0:beta2:*:*:*:*:*:* Versions 4.0.0 beta2 Vulnerable ·Craft CMS
  • cpe:2.3:a:craftcms:craft_cms:4.0.0:beta3:*:*:*:*:*:* Versions 4.0.0 beta3 Vulnerable ·Craft CMS
  • cpe:2.3:a:craftcms:craft_cms:4.0.0:beta4:*:*:*:*:*:* Versions 4.0.0 beta4 Vulnerable ·Craft CMS
  • cpe:2.3:a:craftcms:craft_cms:4.0.0:rc1:*:*:*:*:*:* Versions 4.0.0 rc1 Vulnerable ·Craft CMS
  • cpe:2.3:a:craftcms:craft_cms:4.0.0:rc2:*:*:*:*:*:* Versions 4.0.0 rc2 Vulnerable ·Craft CMS
  • cpe:2.3:a:craftcms:craft_cms:4.0.0:rc3:*:*:*:*:*:* Versions 4.0.0 rc3 Vulnerable ·Craft CMS
  • cpe:2.3:a:craftcms:craft_cms:5.0.0:-:*:*:*:*:*:* Versions 5.0.0 Vulnerable ·Craft CMS
Show 1 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:craftcms:craft_cms:5.0.0:rc1:*:*:*:*:*:*5.0.0 rc1VulnerableCraft CMS
  • cpe:2.3:a:craftcms:craft_cms:5.0.0:rc1:*:*:*:*:*:* Versions 5.0.0 rc1 Vulnerable ·Craft CMS

Remediation

  • Fix · CNA cms (craftcms) Fixed in 5.9.9, 4.17.4
  • Fix · GHSA-fp5j-j7j4-mcxc craftcms/cms (Packagist) Fixed in 5.9.9 Advisory →
  • Fix · GHSA-fp5j-j7j4-mcxc craftcms/cms (Packagist) Fixed in 4.17.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-31857
  2. 2026-10-03 Alias added: GHSA-fp5j-j7j4-mcxc

References

Patch 2

Advisory 1

Other 1

  • TI-2025-23503 Craft CMS Allows Remote Code Execution KEVCVSS 3.1CRITICAL 10.0
  • TI-2024-37138 RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms KEVCVSS 4.0CRITICAL 9.3
  • TI-2025-16994 Potential RCE with a compromised security key in craft/cms KEVCVSS 3.1HIGH 8.1
  • TI-2025-24595 Craft CMS stores user-provided content in session files KEVCVSS 4.0MEDIUM 6.9
  • TI-2023-22284 Craft CMS Remote Code Execution vulnerability CVSS 3.1CRITICAL 10.0
  • TI-2024-25171 Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint. CVSS 3.1CRITICAL 9.8
See all 96 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences