8.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-31857

CVE-2026-31857: CraftCMS has an RCE vulnerability via relational conditionals in the control panel

Craft is a content management system (CMS). Prior to 5.9.9 and 4.17.4, a Remote Code Execution vulnerability exists in the Craft CMS 5 conditions system. The BaseElementSelectConditionRule::getElementIds() method passes user-controlled string input through renderObjectTemplate() -- an unsandboxed Twig rendering function with escaping disabled. Any authenticated Control Panel user (including non-admin roles such as Author or Editor) can achieve full RCE by sending a crafted condition rule via standard element listing endpoints. This vulnerability requires no admin privileges, no special permissions beyond basic control panel access, and bypasses all production hardening settings (allowAdminChanges: false, devMode: false, enableTwigSandbox: true). Users should update to the patched 5.9.9 or 4.17.4 release to mitigate the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-31857

CVE-2026-31857:

8.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
craftcms/cms	composer	>= 5.0.0-RC1, <= 5.9.8	5.9.9
craftcms/cms	composer	>= 4.0.0-beta.1, <= 4.17.3	4.17.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the BaseElementSelectConditionRule class, specifically within the getElementId method. The description of the vulnerability points out that user-controlled input is passed to the renderObjectTemplate() function, which does not sandbox the Twig rendering, thus allowing for RCE. The provided commit patch confirms this. The patch for the file src/base/conditions/BaseElementSelectConditionRule.php shows a direct replacement of renderObjectTemplate() with renderSandboxedObjectTemplate() inside the getElementId method. This change enforces sandboxed rendering, preventing the execution of arbitrary code. Therefore, any runtime profile during exploitation would show craftcms\cms\base\conditions\BaseElementSelectConditionRule::getElementId in the stack trace as it is the entry point for the malicious payload processing.

Vulnerable functions

craftcms\cms\base\conditions\BaseElementSelectConditionRule::getElementId

src/base/conditions/BaseElementSelectConditionRule.php

The `getElementId` function in the `BaseElementSelectConditionRule` class uses `renderObjectTemplate` to process user-provided input. This function allows for unsandboxed Twig template rendering, leading to Remote Code Execution (RCE) if a malicious string is passed as the element ID. The patch replaces the insecure function with `renderSandboxedObjectTemplate` to mitigate the vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.