A Remote Code Execution vulnerability exists in the Craft CMS 5 conditions system.
The BaseElementSelectConditionRule::getElementIds() method passes user-controlled string input
through renderObjectTemplate() -- an unsandboxed Twig rendering function with escaping disabled.
Any authenticated Control Panel user (including non-admin roles such as Author or Editor) can achieve full
RCE by sending a crafted condition rule via standard element listing endpoints.
This vulnerability requires no admin privileges, no special permissions beyond basic control panel access, and
bypasses all production hardening settings (allowAdminChanges: false, devMode: false,
enableTwigSandbox: true).
Users should update to the patched 5.99 release to mitigate the issue.
| Score | Percentile |
|---|---|
| 0.12% | 30.79% |
| Base score | Version | Severity | Vector |
|---|---|---|---|
| 8.1 | 4.0 | — |
|
| Type | Value |
|---|---|
| GHSA | GHSA-fp5j-j7j4-mcxc ↗ |
| CVE | CVE-2026-31857 ↗ |
| CWE id | Name |
|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') |
Vulnerable version ranges and first patched releases as published by GitHub.
| Ecosystem | Package | Vulnerable range | First patched | Vulnerable functions |
|---|---|---|---|---|
| composer | craftcms/cms | >= 5.0.0-RC1, <= 5.9.8 | 5.9.9 | — |
| composer | craftcms/cms | >= 4.0.0-beta.1, <= 4.17.3 | 4.17.4 | — |