Craft CMS CVE-2026-109307

Exploitation requires the victim to be a Craft CMS control-panel user with two-factor authentication (TOTP) enabled, because the attack targets the verification step at /admin/login?verify=1. The attacker must deliver a crafted login URL whose returnUrl parameter contains a javascript: scheme, and the victim must actively open it during the narrow window between submitting their password and completing TOTP verification (reflected in AT:P and UI:A). Limiting factors: this is not possible against accounts without 2FA, requires precise timing plus social engineering, requires victim interaction, and executes only with the victim's existing control-panel permissions rather than granting elevation; there is no server-side impact (VC/VI/VA:N).

This is a genuinely low-priority issue, and the multiple signals agree rather than conflict. The vendor-assigned CVSS 4.0 score is 2.1 (Low), driven by the fact that the vulnerability produces no impact on the vulnerable system itself (VC:N/VI:N/VA:N) and only low subsequent-system confidentiality and integrity impact (SC:L/SI:L). Critically, the vector includes AT:P (a specific attack requirement - the narrow timing window between password submission and TOTP entry) and UI:A (active victim interaction required), both of which sharply constrain real-world exploitability. There is no EPSS score, no CISA KEV listing, and no public exploit code referenced in the provided data, so exploitation is entirely theoretical at this time: no public exploit identified at time of analysis. No SSVC decision data was supplied. Although PR:N technically means the attacker needs no privileges, successful exploitation depends on a highly specific social-engineering and timing sequence against a 2FA-enabled administrator, which makes mass or automated exploitation impractical. This is a legitimate DOM-XSS defect worth patching during normal maintenance, not an emergency; the low CVSS accurately reflects low real-world risk.

An attacker crafts a malicious /admin/login?verify=1 URL whose returnUrl parameter carries a javascript: payload and socially engineers a Craft CMS administrator with 2FA enabled into opening it during login - specifically in the window after the password is submitted but before the TOTP code is verified. When the client-side code navigates to the attacker-controlled returnUrl, the JavaScript executes in the authenticated control panel context with the victim's permissions. No public proof-of-concept exploit is referenced in the available data.