Packagist/craftcms/webhooks CVE-2026-32261: high 8.5, EPSS 0.41%
RCE via SSTI for users with permissions to access the Craft CMS Webhooks plugin
Action: Upgrade craftcms/webhooks to 3.2.0 or later.
composer require craftcms/webhooks:3.2.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.0.0 | 3.2.0 | - |
Fixed versions
| 3.2.0 |
Sources
- osv: GHSA-8wg7-wm29-2rvg
- nvd: CVE-2026-32261
- https://github.com/craftcms/webhooks/security/advisories/GHSA-8wg7-wm29-2rvg
- https://github.com/craftcms/webhooks/commit/88344991a68b07145567c46dfd0ae3328c521f62
- https://github.com/craftcms/webhooks
CVE-2026-32261 · published · modified · JSON