# CVE-2026-56383: Craft CMS stored XSS in editableTable.twig row headings

Source: https://junglewise.ai/threats/cve-2026-56383-craft-cms-stored-xss-in-editabletable-twig-row-headings  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-21. Updated: 2026-08-06  
License: CC BY 4.0 with a link back

CVE-2026-56383 · Severity: medium · CVSS 4.8 · Published 2026-06-21

Craft CMS, a content management system used to build and manage websites, contains a security flaw in its table field component. An attacker with administrative access could insert malicious code into a table's row heading, which would then execute in the browser of any user viewing that table. This could lead to unauthorized actions being performed on behalf of other users, though it requires a specific configuration that is generally discouraged in production environments.

Technologies: [craftcms/cms (Packagist)](https://junglewise.ai/threats/technologies/craftcms-cms). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-56383 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56383 being exploited in the wild.

**How severe is CVE-2026-56383?** Medium severity, with a CVSS score of 4.8, published 21 June 2026.

**Which products and versions are affected?** craftcms/cms (Packagist) ECOSYSTEM:introduced=4.5.0-beta.1,fixed=4.16.19.

**Is there a fix for CVE-2026-56383?** Yes. craftcms/cms (Packagist): upgrade to 4.16.19 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56383 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-56383?** Check whether you run craftcms/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- craftcms/cms (Packagist): upgrade to 4.16.19 or later

  ```sh
  composer require craftcms/cms:^4.16.19
  ```


## Technical details

A stored Cross-site Scripting (XSS) vulnerability exists in Craft CMS within the `editableTable.twig` component. The vulnerability is rooted in the lack of input sanitization for the 'Row Heading' column type in Table fields. An attacker with administrative privileges can inject a malicious payload (e.g., an `<img>` tag with an `onerror` attribute) into the default values of a table field. When another user views an object containing this field, the payload executes in their browser context. Exploitation requires the `allowAdminChanges` setting to be enabled, which is contrary to security best practices for production environments. The issue is patched in versions 4.16.19 and 5.8.23.

## Affected products

- Pixel & Tonic Craft CMS >= 4.5.0-beta.1, <= 4.16.18; >= 5.0.0-RC1, <= 5.8.22

## Identifiers

- CVE-2026-56383
- GHSA-6j87-m5qx-9fqp

## Timeline

- 2026-02-23: patched: Fixes released in versions 4.16.19 and 5.8.23
- 2026-02-25: advisory: GitHub Advisory published

## References

- [https://api.github.com/users/mHe4am](https://api.github.com/users/mHe4am)
- [https://github.com/mHe4am](https://github.com/mHe4am)
- [https://api.github.com/users/mHe4am/gists%7B/gist_id%7D](https://api.github.com/users/mHe4am/gists%7B/gist_id%7D)
- [https://api.github.com/users/mHe4am/repos](https://api.github.com/users/mHe4am/repos)
- [https://avatars.githubusercontent.com/u/138346620?v=4](https://avatars.githubusercontent.com/u/138346620?v=4)
- [https://api.github.com/users/mHe4am/events%7B/privacy%7D](https://api.github.com/users/mHe4am/events%7B/privacy%7D)

## Related threats

- [Craft CMS: Stored XSS in the control panel via unescaped draft name](https://junglewise.ai/threats/cve-2026-72787-craft-cms-stored-xss-in-the-control-panel-via-unescaped-draft)
- [Craft CMS: Arbitrary user password reset leading to administrator account takeover](https://junglewise.ai/threats/cve-2026-72786-craft-cms-arbitrary-user-password-reset-leading-to-administrator)
- [Craft CMS authorization bypass in category structure modification](https://junglewise.ai/threats/craft-cms-authorization-bypass-in-category-structure-modification-1555f980)
- [Craft CMS authenticated RCE through Twig sandbox escape](https://junglewise.ai/threats/craft-cms-authenticated-rce-through-twig-sandbox-escape-32ee5ec1)
- [Craft CMS path traversal in ensurePathIsContained](https://junglewise.ai/threats/craft-cms-path-traversal-in-ensurepathiscontained-4adc3058)