HighGHSA-fp5j-j7j4-mcxcCVE-2026-31857

CraftCMS has an RCE vulnerability via relational conditionals in the control panel

Published 11 Mar 2026 · Updated 13 Mar 2026

Affected packages

craftcms/cmsComposer

Affected: >=5.0.0-RC1 <5.9.9
Fixed in: 5.9.9

Update to the fixed version for your release line, for example:composer require craftcms/cms:^5.9.9

craftcms/cmsComposer

Affected: >=4.0.0-beta.1 <4.17.4
Fixed in: 4.17.4

Update to the fixed version for your release line, for example:composer require craftcms/cms:^4.17.4

Details

A Remote Code Execution vulnerability exists in the Craft CMS 5 conditions system.

The BaseElementSelectConditionRule::getElementIds() method passes user-controlled string input through renderObjectTemplate() -- an unsandboxed Twig rendering function with escaping disabled.

Any authenticated Control Panel user (including non-admin roles such as Author or Editor) can achieve full RCE by sending a crafted condition rule via standard element listing endpoints.

This vulnerability requires no admin privileges, no special permissions beyond basic control panel access, and bypasses all production hardening settings (allowAdminChanges: false, devMode: false, enableTwigSandbox: true).

Users should update to the patched 5.99 release to mitigate the issue.

Is GHSA-fp5j-j7j4-mcxc in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected craftcms/cms, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.