CVE-2026-31857: CraftCMS has an RCE vulnerability via relational conditionals in the control panel
A Remote Code Execution vulnerability exists in the Craft CMS 5 conditions system.
The BaseElementSelectConditionRule::getElementIds() method passes user-controlled string input through renderObjectTemplate() -- an unsandboxed Twig rendering function with escaping disabled.
Any authenticated Control Panel user (including non-admin roles such as Author or Editor) can achieve full RCE by sending a crafted condition rule via standard element listing endpoints.
This vulnerability requires no admin privileges, no special permissions beyond basic control panel access, and bypasses all production hardening settings (allowAdminChanges: false, devMode: false, enableTwigSandbox: true).
Users should update to the patched 5.99 release to mitigate the issue.
Other sources
Craft is a content management system (CMS). Prior to 5.9.9 and 4.17.4, a Remote Code Execution vulnerability exists in the Craft CMS 5 conditions system. The BaseElementSelectConditionRule::getElementIds() method passes user-controlled string input through renderObjectTemplate() -- an unsandboxed Twig rendering function with escaping disabled. Any authenticated Control Panel user (including non-admin roles such as Author or Editor) can achieve full RCE by sending a crafted condition rule via standard element listing endpoints. This vulnerability requires no admin privileges, no special permissions beyond basic control panel access, and bypasses all production hardening settings (allowAdminChanges: false, devMode: false, enableTwigSandbox: true). Users should update to the patched 5.9.9 or 4.17.4 release to mitigate the issue.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31857?
CVE-2026-31857 is classified as a Remote Code Execution vulnerability which is considered highly severe.
How do I fix CVE-2026-31857?
To fix CVE-2026-31857, upgrade Craft CMS to version 4.17.4 or 5.9.9.
What is the impact of CVE-2026-31857 on Craft CMS?
CVE-2026-31857 allows authenticated users to execute arbitrary code due to unsanitized input in the Twig rendering process.
Which versions of Craft CMS are affected by CVE-2026-31857?
Craft CMS versions between 4.0.0-beta.1 and 4.17.3, and between 5.0.0-RC1 and 5.9.8 are affected by CVE-2026-31857.
Is there a workaround for CVE-2026-31857?
Currently, the recommended approach is to update to a fixed version, as there is no official workaround for CVE-2026-31857.