Is CVE-2026-109307 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109307 being exploited in the wild.

How severe is CVE-2026-109307?

Medium severity, with a CVSS score of 4.7, published 12 October 2026.

Which products and versions are affected?

Craft CMS 5.0.0 before 5.10.14.

Is there a fix for CVE-2026-109307?

Yes: fixed in 5.10.14. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-109307 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-109307?

Check whether you run Craft CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109307: Craft CMS DOM-based cross-site scripting in 2FA verification

CVE-2026-109307 · Severity: medium · CVSS 4.7 · Published 2026-10-12

Craft CMS is a content management system used to build and manage websites. The control panel login flow contains a cross-site scripting flaw that allows attackers to execute malicious JavaScript in an authenticated admin session. An attacker can trick a user with two-factor authentication enabled into clicking a malicious login link, and once the user completes authentication and verification, the attacker's code runs with the user's permissions, potentially allowing unauthorized changes to site content and configuration.

Technologies: Craft CMS. Vendors: Craft.

Quick answers

Is CVE-2026-109307 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109307 being exploited in the wild.
How severe is CVE-2026-109307?: Medium severity, with a CVSS score of 4.7, published 12 October 2026.
Which products and versions are affected?: Craft CMS 5.0.0 before 5.10.14.
Is there a fix for CVE-2026-109307?: Yes: fixed in 5.10.14. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109307 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-109307?: Check whether you run Craft CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 5.10.14

Technical details

A DOM-based XSS vulnerability exists in the login and 2FA verification flow where a user-controlled returnUrl parameter accepts javascript: URLs and is used in client-side navigation after successful authentication. Exploitation requires the victim to have 2FA enabled and to click a crafted /admin/login?verify=1 URL after submitting their password but before completing TOTP verification. The attacker-controlled JavaScript then executes in the authenticated /admin origin, enabling same-origin privileged actions such as forging authenticated API requests to modify entries, disable content, or alter site configuration.

Affected products

Craft CMS 5.0.0 before 5.10.14

Timeline

2026-09-22: disclosed
2026-10-12: advisory
2026-10-12: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.