Platform
php
Component
craftcms/cms
Fixed in
5.0.1
4.0.1
5.9.9
CVE-2026-31857 describes a Remote Code Execution (RCE) vulnerability within the Craft CMS 5 conditions system. This vulnerability allows authenticated Control Panel users, even those with non-admin roles like Authors or Editors, to achieve full RCE. The vulnerability impacts Craft CMS versions 5.9.8 and earlier, and a fix is available in version 5.9.9.
The impact of CVE-2026-31857 is significant due to the potential for Remote Code Execution. An attacker, with only basic Control Panel access, can execute arbitrary code on the server hosting the Craft CMS instance. This could lead to complete system compromise, including data exfiltration, modification, or deletion. The lack of administrative privileges required for exploitation expands the attack surface considerably, as a wider range of users could potentially trigger the vulnerability. This is particularly concerning given the popularity of Craft CMS for content-heavy websites and applications, which often store sensitive user data.
CVE-2026-31857 was publicly disclosed on March 11, 2026. The vulnerability leverages an unsandboxed Twig rendering function, similar to vulnerabilities seen in other templating engines. Currently, there are no known active campaigns exploiting this specific CVE, but the availability of a public proof-of-concept increases the likelihood of future exploitation. The EPSS score is pending evaluation, but the RCE nature and ease of exploitation suggest a potential medium to high probability of exploitation.
Exploit Status
EPSS
0.10% (28% percentile)
CISA SSVC
The primary mitigation for CVE-2026-31857 is to upgrade Craft CMS to version 5.9.9 or later. If an immediate upgrade is not feasible, consider implementing strict input validation on condition rule parameters to prevent malicious code injection. While not a complete solution, a Web Application Firewall (WAF) configured to block requests containing suspicious condition rule payloads could provide a temporary layer of defense. Monitor Craft CMS logs for unusual activity related to element listing endpoints and condition rule processing. After upgrading, confirm the vulnerability is resolved by attempting to create a condition rule with a known malicious payload – it should be rejected.
Update Craft CMS to version 5.9.9 or 4.17.4, as appropriate, to mitigate the remote code execution vulnerability. This update corrects how condition rules are processed in the control panel, preventing the execution of unwanted code. It is recommended to perform the update as soon as possible.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-31857 is a Remote Code Execution vulnerability affecting Craft CMS versions 5.9.8 and earlier. It allows authenticated Control Panel users to execute arbitrary code.
You are affected if you are running Craft CMS version 5.9.8 or earlier. Upgrade to 5.9.9 or later to mitigate the vulnerability.
Upgrade Craft CMS to version 5.9.9 or later. As a temporary workaround, implement strict input validation on condition rule parameters and consider WAF rules.
While there are currently no confirmed active campaigns, the availability of a public proof-of-concept increases the risk of future exploitation.
Refer to the official Craft CMS security advisory for detailed information and updates: [https://craftcms.com/security/advisories](https://craftcms.com/security/advisories)
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.