Executive brief
Craft CMS is a content management system used by organizations to manage web content and editorial workflows. A stored XSS vulnerability in the Generated Fields feature allows low-privilege content editors to inject malicious JavaScript that executes in the authenticated Control Panel sessions of higher-privileged administrators and other users viewing content indexes. This privilege escalation could lead to unauthorized actions, data theft, or further system compromise performed under an administrator's authority.
Technical details
The vulnerability is a stored cross-site scripting (CWE-79) in Craft CMS's Generated Fields feature, which renders admin-authored Twig templates to compute display values for elements. The root cause is that the rendering process explicitly disables Twig autoescaping and the display paths (Table and Card views) fail to apply HTML encoding to cached values. An attacker with content editor privileges can inject HTML/JavaScript payloads into editable fields referenced by the Twig template; when higher-privileged users (including administrators) view the element index, the stored payload executes in their authenticated session. The attack vector is network-based and requires authentication (content editor access) and user interaction (admin viewing the index). The vulnerability affects Craft CMS versions 5.7.0 through 5.10.12; patch 5.10.13 is available.
Affected products
- Craft CMS 5.7.0 before 5.10.13
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: Version 5.10.13 available