8.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32261

CVE-2026-32261: RCE via SSTI for users with permissions to access the Craft CMS Webhooks plugin

Webhooks for Craft CMS plugin adds the ability to manage “webhooks” in Craft CMS, which will send GET or POST requests when certain events occur. From version 3.0.0 to before version 3.2.0, the Webhooks plugin renders user-supplied template content through Twig’s renderString() function without sandbox protection. This allows an authenticated user with access to the Craft control panel and permissions to access the Webhooks plugin to inject Twig template code that calls arbitrary PHP functions. This is possible even if allowAdminChanges is set to false. This issue has been patched in version 3.2.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32261

CVE-2026-32261:

8.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
craftcms/webhooks	composer	>= 3.0.0, < 3.2.0	3.2.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Template Injection (SSTI) in the craftcms/webhooks plugin. The analysis of the patch in commit 88344991a68b07145567c46dfd0ae3328c521f62 reveals that the root cause is the use of Twig's renderString function without sandboxing. The changes are located in src/Plugin.php within an anonymous function (a closure) that handles webhook processing. This function renders user-supplied data for various parts of the webhook, including the payload, headers, URL, and debounce key. The patch replaces all instances of $view->renderString() with $view->renderSandboxedString(), effectively closing the template injection vector. Therefore, the anonymous function, which a profiler would likely identify as craft\webhooks\Plugin->{closure}, is the vulnerable function as it is the entry point for processing the malicious user input.

Vulnerable functions

craft\webhooks\Plugin->{closure}

src/Plugin.php

This anonymous function (closure) within the `Plugin` class processes webhook data. It uses the unsandboxed Twig function `renderString` to render user-controlled templates for the webhook payload, headers, URL, and debounce key. This allows an authenticated user with permissions for the Webhooks plugin to inject malicious Twig code, leading to Server-Side Template Injection (SSTI) and potential Remote Code Execution (RCE). The patch mitigates this by replacing `renderString` with the sandboxed `renderSandboxedString`.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.