CVE-2026-31857-craftcms-ssti

CVE-2026-31857 — Craft CMS authenticated SSTI An authorized reproducer for an authenticated server-side template injection in Craft CMS. A user with control-panel access can reach a condition-builder sink that evaluates an attacker-controlled object template in an unsandboxed Twig context, enabli...