Executive brief
Craft CMS, a popular content management system, is vulnerable to a security flaw where malicious scripts can be saved in various administrative settings. If an attacker with administrative access saves a specially crafted name for a section, user group, or field, the script could execute in the browser of other administrators. This could lead to unauthorized actions being performed on behalf of other users or the theft of sensitive session information.
Technical details
Multiple stored Cross-Site Scripting (XSS) vulnerabilities exist in Craft CMS due to improper neutralization of input in the `_includes/forms/checkbox.twig` template, which uses the `|raw` filter on labels. An attacker with administrative privileges (and `allowAdminChanges` enabled) can inject malicious payloads into various sources including Section Names, Volume Names, User Group Names, Global Set Names, and Field Option Labels. These payloads are then executed when rendered in 'sinks' such as the Sources checklist in field settings or user permission pages. The vulnerability is addressed in versions 4.17.0-beta.1 and 5.9.0-beta.1.
Affected products
- Pixel & Tonic Craft CMS >= 4.0.0-RC1, < 4.17.0-beta.1; >= 5.0.0-RC1, < 5.9.0-beta.1
Timeline
- 2026-03-02: disclosed
- 2026-03-03: advisory