GHSA-8wg7-wm29-2rvg

Source

https://github.com/advisories/GHSA-8wg7-wm29-2rvg

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-8wg7-wm29-2rvg/GHSA-8wg7-wm29-2rvg.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-8wg7-wm29-2rvg

Aliases

CVE-2026-32261

Published

2026-03-16T18:11:23Z

Modified

2026-03-16T22:01:25Z

Severity

8.5 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

RCE via SSTI for users with permissions to access the Craft CMS Webhooks plugin

Details

The Webhooks plugin renders user-supplied template content through Twig’s renderString() function without sandbox protection. This allows an authenticated user with access to the Craft control panel and permissions to access the Webhooks plugin to inject Twig template code that calls arbitrary PHP functions.

This is possible even if allowAdminChanges is set to false.

Affected users should update to version 3.2.0 to mitigate the issue.

Database specific

{
    "cwe_ids":  [
        "CWE-1336"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-16T18:11:23Z",
    "nvd_published_at":  "2026-03-16T19:16:17Z",
    "severity":  "HIGH"
}

References

Affected packages

Packagist / craftcms/webhooks

Package

Name: craftcms/webhooks
Purl: pkg:composer/craftcms/webhooks

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.0.0

Fixed

3.2.0

Affected versions

3.*

3.0.0

3.0.1

3.0.2

3.0.3

3.0.4

3.0.5

3.1.0

3.1.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-8wg7-wm29-2rvg/GHSA-8wg7-wm29-2rvg.json"