GitHub Advisoryadvisory · Packagist

GHSA-8wg7-wm29-2rvg RCE via SSTI for users with permissions to access the Craft CMS Webhooks plugin

HIGH Published 2026-03-16 Modified 2026-03-16 Official page ↗
Aliases
CVE-2026-32261
Ecosystem
Packagist
Packages
craftcms/webhooks
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-1336
Reviewed
2026-03-16

Affected packages

• Packagist craftcms/webhooks: >= 3.0.0, < 3.2.0 → fixed in 3.2.0

Description

The Webhooks plugin renders user-supplied template content through Twig’s `renderString()` function without sandbox protection. This allows an authenticated user with access to the Craft control panel and permissions to access the Webhooks plugin to inject Twig template code that calls arbitrary PHP functions. This is possible even if `allowAdminChanges` is set to `false`. Affected users should update to version 3.2.0 to mitigate the issue.

Related

Alias · CVE (1)

  • CVE-2026-32261 Webhooks for Craft CMS plugin adds the ability to manage “webhooks” in Craft CMS, which will send GET or POST requests when certain events… vulnerability

Weakness · CWE (1)

  • CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine weakness

References