CVE-2026-32261 RCE via SSTI for users with permissions to access the Craft CMS Webhooks plugin
Authenticated users with Webhooks plugin access can execute arbitrary PHP code via Twig template injection in Craft CMS.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-32261?
CVE-2026-32261 is a high-severity code injection vulnerability in craftcms webhooks, published on 16 Mar 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Webhooks for Craft CMS plugin adds the ability to manage “webhooks” in Craft CMS, which will send GET or POST requests when certain events occur. From version 3.0.0 to before version 3.2.0, the Webhooks plugin renders user-supplied template content through Twig’s renderString() function without sandbox protection. This allows an authenticated user with access to the Craft control panel and permissions to access the Webhooks plugin to inject Twig template code that calls arbitrary PHP functions. This is possible even if allowAdminChanges is set to false. This issue has been patched in version 3.2.0.
Weakness: CWE-1336
Which versions are affected by CVE-2026-32261?
2 open source packages ship an affected version, including craftcms/webhooks.
| Package | Affected | Fixed in |
|---|---|---|
craftcms/webhooks Packagist | From 3.0.0 | 3.2.0 |
craftcms/webhooks Packagist | From 3.0.0 | 3.2.0 |
How do I fix CVE-2026-32261?
Upgrade craftcms/webhooks to 3.2.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-32261 being exploited?
There is no known exploitation of CVE-2026-32261 in the wild and no public exploit code.
Sources
Also known as GHSA-8wg7-wm29-2rvg.