What is CVE-2026-31857?

CVE-2026-31857 is a high-severity vulnerability in Craftcms Cms, classified under Code Injection. CVSS score: 8.8/10. Published 2026-03-11.

How severe is CVE-2026-31857?

High severity. CVSS v3 base score is 8.8 out of 10.

Is CVE-2026-31857 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

RCE in Craftcms Cms

CVE-2026-31857

Craft is a content management system (CMS). Prior to 5.9.9 and 4.17.4, a Remote Code Execution vulnerability exists in the Craft CMS 5 conditions system. The BaseElementSelectConditionRule::getElementIds() method passes user-controlled string input through renderObjectTemplate() -- an unsandboxed Twig rendering function with escaping disabled. Any authenticated Control Panel user (including non-admin roles such as Author or Editor) can achieve full RCE by sending a crafted condition rule via standard element listing endpoints. This vulnerability requires no admin privileges, no special permissions beyond basic control panel access, and bypasses all production hardening settings (allowAdminChanges: false, devMode: false, enableTwigSandbox: true). Users should update to the patched 5.9.9 or 4.17.4 release to mitigate the issue.

Vulnerability class: RCE (Remote Code Execution)

Published 2026-03-11 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.009 (57.6th percentile), scored 2026-09-29.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 58th percentile — 57.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.007 · newest: 0.009 · change: +0.002

Affected products

Craftcms Cms — versions >= 5.0.0-RC1, < 5.9.9, >= 4.0.0-beta.1, < 4.17.4
Craftcms Craft Cms — versions 4.0.0, 5.0.0

Weakness classification (CWE)

CWE-94 — Code Injection

Public proof-of-concept exploits

0xTatsuki/CVE-2026-31857

References

github.com/craftcms/cms/security/advisories/GHSA-fp5j-j7j4-mcxc (Patch, Vendor Advisory)
github.com/craftcms/cms/commit/8d4903647dcfd31b8d40ed027e27082013347a80 (Patch)

Frequently asked questions

What is CVE-2026-31857?: CVE-2026-31857 is a high-severity vulnerability in Craftcms Cms, classified under Code Injection. CVSS score: 8.8/10. Published 2026-03-11.
How severe is CVE-2026-31857?: High severity. CVSS v3 base score is 8.8 out of 10.
Is CVE-2026-31857 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.