Tóm tắt nhanh
- CVE-2026-31857 là lỗ hổng mức CAO (CVSS 8.8) ảnh hưởng craftcms/cms, craft cms (craftcms).
- Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.86%, cao hơn 58.6% các lỗ hổng khác.
- Cách xử lý: cập nhật lên 4.17.4, 5.9.9 hoặc mới hơn.
| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|
| craftcms/cms Packagist | ≥ 4.0.0-beta.1, < 4.17.4≥ 5.0.0-RC1, < 5.9.9
| 4.17.45.9.9
|
| craft cms | = 4.0.0= 5.0.0≥ 4.0.0.1, < 4.17.4≥ 5.0.1, < 5.9.9
| 4.17.45.9.9
|
Mô tả
A Remote Code Execution vulnerability exists in the Craft CMS 5 conditions system.
The BaseElementSelectConditionRule::getElementIds() method passes user-controlled string input
through renderObjectTemplate() -- an unsandboxed Twig rendering function with escaping disabled.
Any authenticated Control Panel user (including non-admin roles such as Author or Editor) can achieve full
RCE by sending a crafted condition rule via standard element listing endpoints.
This vulnerability requires no admin privileges, no special permissions beyond basic control panel access, and
bypasses all production hardening settings (allowAdminChanges: false, devMode: false,
enableTwigSandbox: true).
Users should update to the patched 5.99 release to mitigate the issue.
Mô tả của NVD
Craft is a content management system (CMS). Prior to 5.9.9 and 4.17.4, a Remote Code Execution vulnerability exists in the Craft CMS 5 conditions system. The BaseElementSelectConditionRule::getElementIds() method passes user-controlled string input through renderObjectTemplate() -- an unsandboxed Twig rendering function with escaping disabled. Any authenticated Control Panel user (including non-admin roles such as Author or Editor) can achieve full RCE by sending a crafted condition rule via standard element listing endpoints. This vulnerability requires no admin privileges, no special permissions beyond basic control panel access, and bypasses all production hardening settings (allowAdminChanges: false, devMode: false, enableTwigSandbox: true). Users should update to the patched 5.9.9 or 4.17.4 release to mitigate the issue.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí