Is CVE-2026-56383 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56383 being exploited in the wild.

How severe is CVE-2026-56383?

Medium severity, with a CVSS score of 4.8, published 21 June 2026.

Which products and versions are affected?

craftcms/cms (Packagist) ECOSYSTEM:introduced=4.5.0-beta.1,fixed=4.16.19.

Is there a fix for CVE-2026-56383?

Yes. craftcms/cms (Packagist): upgrade to 4.16.19 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-56383 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-56383?

Check whether you run craftcms/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56383: Craft CMS stored XSS in editableTable.twig row headings

CVE-2026-56383 · Severity: medium · CVSS 4.8 · Published 2026-06-21

Craft CMS, a content management system used to build and manage websites, contains a security flaw in its table field component. An attacker with administrative access could insert malicious code into a table's row heading, which would then execute in the browser of any user viewing that table. This could lead to unauthorized actions being performed on behalf of other users, though it requires a specific configuration that is generally discouraged in production environments.

Technologies: craftcms/cms (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-56383 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56383 being exploited in the wild.
How severe is CVE-2026-56383?: Medium severity, with a CVSS score of 4.8, published 21 June 2026.
Which products and versions are affected?: craftcms/cms (Packagist) ECOSYSTEM:introduced=4.5.0-beta.1,fixed=4.16.19.
Is there a fix for CVE-2026-56383?: Yes. craftcms/cms (Packagist): upgrade to 4.16.19 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56383 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-56383?: Check whether you run craftcms/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

craftcms/cms (Packagist): upgrade to 4.16.19 or later
```
composer require craftcms/cms:^4.16.19
```

Technical details

A stored Cross-site Scripting (XSS) vulnerability exists in Craft CMS within the `editableTable.twig` component. The vulnerability is rooted in the lack of input sanitization for the 'Row Heading' column type in Table fields. An attacker with administrative privileges can inject a malicious payload (e.g., an `<img>` tag with an `onerror` attribute) into the default values of a table field. When another user views an object containing this field, the payload executes in their browser context. Exploitation requires the `allowAdminChanges` setting to be enabled, which is contrary to security best practices for production environments. The issue is patched in versions 4.16.19 and 5.8.23.

Affected products

Pixel & Tonic Craft CMS >= 4.5.0-beta.1, <= 4.16.18; >= 5.0.0-RC1, <= 5.8.22

Identifiers

CVE-2026-56383
GHSA-6j87-m5qx-9fqp

Timeline

2026-02-23: patched: Fixes released in versions 4.16.19 and 5.8.23
2026-02-25: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.