CVE-2026-32271

{
  "id": "CVE-2026-32271",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-13T21:16:24.260",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Craft Commerce is an ecommerce platform for Craft CMS. In versions 4.0.0 through 4.10.2 and 5.0.0 through 5.5.4, there is an SQL injection vulnerability in the Commerce TotalRevenue widget which allows any authenticated control panel user to achieve remote code execution through a four-step exploitation chain. The attack exploits unsanitized widget settings interpolated into SQL expressions, combined with PDO's default multi-statement query support, to inject a maliciously serialized PHP object into the queue table. When the queue consumer processes the injected job, the unrestricted unserialize() call in yii2-queue instantiates a GuzzleHttp FileCookieJar gadget chain whose __destruct() method writes a PHP webshell to the server's webroot. The complete chain requires only three HTTP requests, no administrative privileges, and results in arbitrary command execution as the PHP process user, with queue processing triggered via an unauthenticated endpoint. This issue has been fixed in versions 4.10.3 and 5.5.5."
    },
    {
      "lang": "es",
      "value": "Craft Commerce es una plataforma de comercio electrónico para Craft CMS. En las versiones 4.0.0 a 4.10.2 y 5.0.0 a 5.5.4, existe una vulnerabilidad de inyección SQL en el widget Commerce TotalRevenue que permite a cualquier usuario autenticado del panel de control lograr la ejecución remota de código a través de una cadena de explotación de cuatro pasos. El ataque explota configuraciones de widget no saneadas interpoladas en expresiones SQL, combinadas con el soporte de consultas multi-sentencia predeterminado de PDO, para inyectar un objeto PHP maliciosamente serializado en la tabla de la cola. Cuando el consumidor de la cola procesa el trabajo inyectado, la llamada unserialize() sin restricciones en yii2-queue instancia una cadena de gadgets GuzzleHttp FileCookieJar cuyo método __destruct() escribe una webshell PHP en la raíz web del servidor. La cadena completa requiere solo tres solicitudes HTTP, sin privilegios administrativos, y resulta en la ejecución arbitraria de comandos como el usuario del proceso PHP, con el procesamiento de la cola activado a través de un endpoint no autenticado. Este problema ha sido solucionado en las versiones 4.10.3 y 5.5.5."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "craftcms",
          "product": "commerce",
          "versions": [
            {
              "version": ">= 4.0.0, < 4.10.3",
              "status": "affected"
            },
            {
              "version": ">= 5.0.0, < 5.5.5",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 7.7,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-16T13:21:36.304718Z",
          "id": "CVE-2026-32271",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/craftcms/commerce/commit/6d2d24b3a2b0c06593856d05446f82bd8af92d72",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/craftcms/commerce/security/advisories/GHSA-875v-7m49-8x88",
      "source": "[email protected]"
    }
  ]
}