CVE-2026-32261: 
PHP vulnerability analysis and mitigation

CVE-2026-32261 is a Server-Side Template Injection (SSTI) vulnerability in the Craft CMS Webhooks plugin that enables Remote Code Execution (RCE) for authenticated users with control panel access. The flaw affects craftcms/webhooks versions >= 3.0.0 and < 3.2.0 (Composer package). It was published and patched on March 16, 2026, with the fix released in version 3.2.0. The vulnerability carries a CVSS v4.0 base score of 8.5 (High) (Github Advisory, GHSA Advisory).

The root cause is classified as CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine). The Webhooks plugin passes user-supplied template content — including payload, header, webhook URL, and debounce key templates — directly to Twig's renderString() function without enabling sandbox protection, allowing injected Twig expressions to call arbitrary PHP functions. Exploitation requires only network access and authenticated control panel credentials with Webhooks plugin permissions; no user interaction is needed, and the vulnerability persists even when allowAdminChanges is set to false. The fix (commit 8834499) resolves the issue by enabling the Twig sandbox environment when enableTwigSandbox is configured, and bumps the minimum Craft CMS requirement to 4.17+ or 5.9+ (Github Advisory, Patch Commit).

Successful exploitation allows an authenticated attacker to execute arbitrary PHP functions on the server, leading to full remote code execution, unauthorized data access, and potential data exfiltration. Both confidentiality and integrity of the vulnerable system are rated High impact, while availability is unaffected per the CVSS scoring. An attacker achieving RCE could pivot to lateral movement within the hosting environment, install backdoors, or exfiltrate sensitive application data and credentials (Github Advisory).

There is no public proof-of-concept exploit or evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.012–0.017%, placing it in the 4th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was reported by researcher "Neosprings" (Github Advisory).

1. Reconnaissance: Identify Craft CMS installations using the Webhooks plugin (versions >= 3.0.0, < 3.2.0) via Composer package metadata, public plugin listings, or web fingerprinting.
2. Obtain credentials: Acquire valid Craft CMS control panel credentials for an account with permissions to access the Webhooks plugin (e.g., through phishing, credential stuffing, or insider access).
3. Access the Webhooks plugin: Log into the Craft CMS control panel and navigate to the Webhooks plugin configuration interface.
4. Inject SSTI payload: In a template field (payload body, header, webhook URL, or debounce key), insert a malicious Twig expression that invokes an arbitrary PHP function, for example: {{ ['id'] | filter('system') | join }} or similar Twig-based PHP function call syntax.
5. Trigger webhook execution: Save the webhook configuration and trigger an event that causes the webhook to fire, causing the server to render the injected template via renderString() without sandbox restrictions.
6. Achieve RCE: The injected PHP function executes on the server, enabling command execution, reverse shell establishment, or data exfiltration (Github Advisory, GHSA Advisory).

• Logs: Craft CMS application logs showing unexpected PHP function calls (e.g., system, exec, shell_exec, passthru) originating from webhook template rendering; PHP error logs with unusual Twig evaluation output.
• File System: Unexpected new files (web shells, scripts) written to the Craft CMS web root or writable directories by the web server process; modification timestamps on plugin files inconsistent with deployment history.
• Network: Outbound connections from the web server to unknown external IPs or domains, particularly following webhook trigger events; unusual DNS lookups from the server process.
• Process: Unexpected child processes spawned by the PHP-FPM or web server process (e.g., bash, sh, curl, wget, python) coinciding with webhook activity.
• Application: New or modified webhook configurations in the Craft CMS control panel containing Twig expressions with PHP function calls; audit log entries showing webhook edits by non-administrative accounts.

The primary remediation is to update the craftcms/webhooks Composer package to version 3.2.0 or later, which introduces Twig sandbox protection for all template rendering. Note that version 3.2.0 also raises the minimum Craft CMS requirement to 4.17+ or 5.9+, so the CMS itself may need to be updated first. As an interim workaround, restrict Craft CMS control panel access and Webhooks plugin permissions to only fully trusted administrators, and audit existing webhook configurations for any suspicious Twig template content. Monitor PHP execution logs for anomalous function calls from webhook processing (Github Advisory, Patch Commit).

The vulnerability was reported by researcher "Neosprings" and published by maintainer "angrybrad" (Brandon Kelly) via GitHub Security Advisories on March 16, 2026. No significant broader media coverage or notable community commentary beyond the advisory itself has been identified at this time (GHSA Advisory).