CVE-2026-31857: 
PHP vulnerability analysis and mitigation

CVE-2026-31857 is a Remote Code Execution (RCE) vulnerability in the Craft CMS conditions system, specifically affecting the BaseElementSelectConditionRule::getElementIds() method. It was published on March 9, 2026, and affects Craft CMS versions >= 5.0.0-RC1 through <= 5.9.8 and >= 4.0.0-beta.1 through <= 4.17.3. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 8.1 (High) (GitHub Advisory, Craft CMS Advisory).

The root cause is classified as CWE-94 (Improper Control of Generation of Code / Code Injection). The vulnerable BaseElementSelectConditionRule::getElementIds() method passes user-controlled string input directly to renderObjectTemplate(), an unsandboxed Twig rendering function with HTML escaping disabled. An attacker with any authenticated Control Panel access — including low-privilege roles such as Author or Editor — can craft a malicious condition rule and submit it via standard element listing endpoints to trigger arbitrary Twig template execution on the server. Critically, the vulnerability bypasses all production hardening settings including allowAdminChanges: false, devMode: false, and enableTwigSandbox: true. The fix replaces the call to renderObjectTemplate() with renderSandboxedObjectTemplate() to enforce Twig sandboxing (Craft CMS Advisory, Fix Commit).

Successful exploitation grants an attacker full Remote Code Execution on the server running Craft CMS, resulting in complete compromise of confidentiality, integrity, and availability. Any authenticated Control Panel user — regardless of role — can execute arbitrary system commands as the web server process, enabling data exfiltration, file system manipulation, installation of backdoors, and potential lateral movement to other systems on the network. No admin privileges or special permissions are required beyond basic Control Panel access (GitHub Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no confirmed evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.138% (34th percentile), indicating a relatively low but non-negligible probability of exploitation within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The vulnerability was discovered and reported by a researcher identified as "Neosprings" (Craft CMS Advisory).

1. Reconnaissance: Identify Craft CMS installations running versions 5.0.0-RC1 through 5.9.8 or 4.0.0-beta.1 through 4.17.3 using web fingerprinting tools (e.g., Wappalyzer, Shodan) or by inspecting HTTP response headers and page metadata.
2. Obtain Control Panel Access: Authenticate to the Craft CMS Control Panel using any valid user account, including low-privilege roles such as Author or Editor. No admin privileges are required.
3. Craft Malicious Condition Rule: Construct a crafted HTTP request targeting a standard element listing endpoint (e.g., entries, assets, or users index) that includes a relational condition rule. Embed a malicious Twig template payload (e.g., {{ ['id'] | filter('system') | join }} or similar unsandboxed Twig expression) in the element ID field of the condition rule.
4. Submit the Payload: Send the crafted request to the element listing endpoint. The server processes the condition rule, and BaseElementSelectConditionRule::getElementIds() passes the attacker-controlled string to renderObjectTemplate() without sandboxing.
5. Achieve RCE: The unsandboxed Twig rendering function evaluates the injected template, executing arbitrary system commands on the server as the web process user, enabling reverse shell establishment, data exfiltration, or further post-exploitation activity (Craft CMS Advisory, Fix Commit).

• Network: Unusual outbound connections from the web server process to external IPs or unexpected internal hosts; HTTP requests to Craft CMS element listing endpoints (e.g., /admin/entries, /admin/assets) containing Twig template syntax ({{, }}, {%, %}) in condition rule parameters.
• Logs: Craft CMS application logs showing errors or unexpected output from renderObjectTemplate() or BaseElementSelectConditionRule; web server access logs with POST requests to element index endpoints from authenticated low-privilege users containing encoded or obfuscated payloads.
• File System: Unexpected new files (web shells, scripts) created in the Craft CMS web root or storage directories; modification timestamps on PHP files inconsistent with deployment history.
• Process: Unusual child processes spawned by the PHP-FPM or web server process (e.g., bash, sh, curl, wget, python, nc); unexpected cron jobs or scheduled tasks added under the web server user account.

Craft CMS has released patched versions addressing this vulnerability: 5.9.9 for the 5.x branch and 4.17.4 for the 4.x branch. All users running affected versions (5.0.0-RC1 through 5.9.8, or 4.0.0-beta.1 through 4.17.3) should upgrade immediately. As a temporary workaround prior to patching, restrict Control Panel access to only fully trusted users and remove accounts for any non-essential or untrusted users. There is no configuration-only mitigation, as the vulnerability bypasses enableTwigSandbox: true and other hardening settings (Craft CMS Advisory, Fix Commit).

The vulnerability was published by Craft CMS maintainer angrybrad on March 9, 2026, and credited to researcher "Neosprings." The advisory was picked up by automated CVE tracking services and vulnerability databases shortly after disclosure, including NVD, CIRCL, and ENISA EUVD. No significant public researcher commentary, media coverage, or notable community discussion beyond standard CVE tracking has been identified at this time (Craft CMS Advisory).