Executive brief
Craft CMS, a popular content management system, is vulnerable to a security flaw where malicious code can be hidden within administrative settings like section names or field labels. An attacker with administrative access could use this to target other staff members, potentially stealing their session information or performing unauthorized actions on their behalf. This issue is resolved in the latest software updates.
Technical details
Multiple stored cross-site scripting (XSS) vulnerabilities exist in Craft CMS due to improper output sanitization in Twig templates, specifically the use of the '|raw' filter in 'checkbox.twig' and other components. An authenticated administrator with 'allowAdminChanges' enabled can inject malicious payloads into section names, volume names, user group names, global set names, and field option labels. These payloads are executed when other users view the affected control panel pages, such as user permissions or field settings. The vulnerability is fixed in versions 4.17.0-beta.1 and 5.9.0-beta.1.
Affected products
- Pixel & Tonic Craft CMS >= 4.0.0-RC1, < 4.17.0-beta.1; >= 5.0.0-RC1, < 5.9.0-beta.1
Timeline
- 2026-03-02: advisory: Original advisory GHSA-4mgv-366x-qxvx published
- 2026-06-21: disclosed: Duplicate advisory GHSA-f95g-vm94-46c3 published
- 2026-08-06: other: Advisory withdrawn as a duplicate
References
- https://github.com/craftcms/cms/security/advisories/GHSA-4mgv-366x-qxvx
- https://github.com/craftcms/cms/commit/67780a778c6ec04e68e64a0b1177c168306144a2
- https://github.com/craftcms/cms/commit/943152d2246b36f12adf161a03b8695b773d9276
- https://www.vulncheck.com/advisories/craft-cms-multiple-stored-cross-site-scripting-in-settings-names-and-field-options