Executive brief
Craft CMS, a content management system used to build and manage websites, contains a security flaw in its table field component. An attacker with administrative access could insert malicious code into a table's row heading, which would then execute in the browser of any user viewing that table. This could lead to unauthorized actions being performed on behalf of other users, though it requires a specific configuration that is generally discouraged in production environments.
Technical details
A stored Cross-site Scripting (XSS) vulnerability exists in Craft CMS within the `editableTable.twig` component. The vulnerability is rooted in the lack of input sanitization for the 'Row Heading' column type in Table fields. An attacker with administrative privileges can inject a malicious payload (e.g., an `<img>` tag with an `onerror` attribute) into the default values of a table field. When another user views an object containing this field, the payload executes in their browser context. Exploitation requires the `allowAdminChanges` setting to be enabled, which is contrary to security best practices for production environments. The issue is patched in versions 4.16.19 and 5.8.23.
Affected products
- Pixel & Tonic Craft CMS >= 4.5.0-beta.1, <= 4.16.18; >= 5.0.0-RC1, <= 5.8.22
Timeline
- 2026-02-23: patched: Fixes released in versions 4.16.19 and 5.8.23
- 2026-02-25: advisory: GitHub Advisory published