CVE-2026-31857

CVE-2026-31857 : RCE du panneau de contrôle de Craft CMS CVE-2026-31857 est une vulnérabilité d'exécution de code à distance dans les règles de condition relationnelle de Craft CMS. BaseElementSelectConditionRule::getElementIds rend une entrée contrôlée par l'utilisateur sous forme de template Tw...

Exploit for Code Injection in Craftcms Craft_Cms

CVE-2026-31857 — Craft CMS Authenticated RCE Timing PoC A sma...

Exploit for Code Injection in Craftcms Craft_Cms

CVE-2026-31857: Craft CMS control panel RCE CVE-2026-31857 is...

Arbitrary Code Injection

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Arbitrary Code Injection via the BaseElementSelectConditionRule::getElementIds function. An attacker can execute arbitrary code by sending a crafted condition rule through standard element...

CVE-2026-31857: Improper Control of Generation of Code

Craft is a content management system CMS. Prior to 5.9.9 and 4.17.4, a Remote Code Execution vulnerability exists in the Craft CMS 5 conditions system. The BaseElementSelectConditionRule::getElementIds method passes user-controlled string input through renderObjectTemplate -- an unsandboxed Twig...