Executive brief
Craft CMS, a popular content management system, is vulnerable to a security flaw where low-privileged users can inject malicious scripts into the administrative control panel. By creating a draft with a specially crafted name, an attacker can target administrators who view that draft during routine tasks. If successful, this allows the attacker to perform actions as the administrator, potentially leading to a full takeover of the website's management interface.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Craft CMS due to improper output encoding of the `draftName` property in the control-panel helper responsible for rendering element chips and cards. A low-privileged user with permissions to create drafts can inject a malicious payload into the draft name. This payload executes in the context of any higher-privileged user, such as an administrator, who views the affected element in indexes, relation fields, or selection fields. An attacker can leverage this to steal CSRF tokens and perform unauthorized administrative actions, such as creating new admin accounts. The issue is fixed in version 5.10.8.
Affected products
- Pixel & Tonic Craft CMS >= 5.0.0-RC1, < 5.10.8
Timeline
- 2026-07-25: patched: Fix released in version 5.10.8
- 2026-08-06: advisory: GitHub Advisory GHSA-2rp4-x2j7-qmcc published