Remote Code Execution in Craft CMS Plugin by Craft
CVE-2026-32261

8.5HIGH

Key Information:

Vendor

Craftcms

Status
Webhooks
Vendor
CVE Published:
16 March 2026

What is CVE-2026-32261?

The Webhooks plugin for Craft CMS, which facilitates the management of webhooks to trigger actions on specific events, has a security flaw that affects versions from 3.0.0 up to just before 3.2.0. This vulnerability arises from the plugin's use of Twig's renderString() function to process user-supplied template content without adequate sandboxing. As a result, authenticated users who have access to the Craft control panel and the Webhooks plugin can inject malicious Twig template code. This injection can execute arbitrary PHP functions, posing a significant risk to the integrity and security of the application. The issue has been addressed in version 3.2.0, and users are urged to upgrade to mitigate the risks associated with this vulnerability.

Affected Version(s)

webhooks >= 3.0.0, < 3.2.0

References

https://github.com/craftcms/webhooks/security/advisories/...
x_refsource_CONFIRM
https://github.com/craftcms/webhooks/commit/88344991a68b0...
x_refsource_MISC

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.