CVE-2026-32261
Webhooks for Craft CMS plugin adds the ability to manage “webhooks” in Craft CMS, which will send GET or POST requests when certain events occur. From version 3.0.0 to before version 3.2.0, the Webhooks plugin renders user-supplied template content through Twig’s renderString() function without sandbox protection. This allows an authenticated user with access to the Craft control panel and permissions to access the Webhooks plugin to inject Twig template code that calls arbitrary PHP functions. This is possible even if allowAdminChanges is set to false. This issue has been patched in version 3.2.0.
https://nvd.nist.gov/vuln/detail/CVE-2026-32261
Categories
CWE-1336 : Improper Neutralization of Special Elements Used in a Template Engine
The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine. This term is used for injection into template engines being used by a server. This term is used for injection into template engines being used by a client. Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.) Choose a template engine that offers a sandbox or restricted mode, or at least limits the power of any available expressions, function calls, or commands. Use the template engine's sandbox or restricted mode, if available. Chain: Python bindings for LLMlibrary do not use a sandboxed environment whenparsing a template and constructing a prompt,allowing jinja2 Server Side Template Injection andcode execution - one variant of a "promptinjection" attack. server-side template injection in content management server authentication / identity management product has client-side template injection Server-Side Template Injection using a Twig template devops platform allows SSTI bypass of Server-Side Template Injection protection mechanism with macros in Velocity templates web browser proxy server allows Java EL expressions from Server-Side Template Injection SSTI involving mail templates and JEXL expressions product does not use a "safe" setting for a FreeMarker configuration, allowing SSTI product allows read of sensitive database username/password variables using server-side template injection
References
security-advisories@github.com
AFFECTED (from MITRE)
| Vendor |
Product |
Versions |
| craftcms |
webhooks |
- >= 3.0.0, < 3.2.0 [affected]
|
| © 2022 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. |
CPE
REMEDIATION
EXPLOITS
Exploit-db.com
| id |
description |
date |
|
| No known exploits |
POC Github
Other Nist (github, ...)
CAPEC
Common Attack Pattern Enumerations and Classifications
| id |
description |
severity |
| No entry |
Cybersecurity needs ?
Strengthen software security from the outset with our DevSecOps expertise
Integrate security right from the start of the software development cycle for more robust applications and greater customer confidence.
Our team of DevSecOps experts can help you secure your APIs, data pipelines, CI/CD chains, Docker containers and Kubernetes deployments.
Discover this offer
