EUVD-2026-38175
GHSA-9r7j-7jhg-4f4c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Admin credentials required (PR:H); victim must visit permissions page (UI:R); payload executes cross-user causing scope change (S:C); no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Craft CMS from version 5.0.0-RC1 contains a stored cross-site scripting vulnerability in the User Permissions page where user group names are rendered without proper HTML escaping. Attackers with admin access can inject arbitrary JavaScript via the user group name field that executes when other users view or edit permissions.
AnalysisAI
Stored XSS in Craft CMS (versions 5.0.0-RC1 through 5.8.21) allows an admin-level attacker to permanently embed malicious JavaScript into the User Permissions page by crafting a user group name with an unsanitized HTML payload. The script executes in the browser of any user who subsequently opens the Permissions tab on a user's edit page, creating a persistent cross-user attack vector within the control panel. Vendor-confirmed proof-of-concept steps are publicly documented in GHSA-g3hp-vvqf-8vw6; no confirmed active exploitation or CISA KEV listing at time of analysis.
Technical ContextAI
Craft CMS (CPE: cpe:2.3:a:craftcms:cms:*:*:*:*:*:*:*:*) is a PHP-based content management system with a Twig-based templating engine. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause: user group name values are stored in the database and subsequently rendered into the User Permissions page HTML template without HTML-entity encoding or output escaping. This is a distinct sink from two prior Craft CMS XSS findings (GHSA-2423-8xxj-wc3g affecting User Settings, and GHSA-vx7g-xw92-g4xj affecting the User Group Edit page), confirming a pattern of inadequate output encoding in the admin control panel's user-management templates. The attack surface is the control panel's /admin/users/{id} Permissions tab, a path reachable by any authenticated admin or privileged user.
RemediationAI
Upgrade Craft CMS to version 5.8.22 or later, which applies output escaping to user group names in the User Permissions page template per the upstream fix referenced in https://github.com/craftcms/cms-ghsa-4mgv-366x-qxvx/pull/2. The vendor advisory is at https://github.com/craftcms/cms/security/advisories/GHSA-g3hp-vvqf-8vw6. As a compensating control prior to patching, set allowAdminChanges = false in your production Craft CMS config/general.php - this is already recommended by Craft's security hardening guide and directly blocks the precondition for exploitation by preventing admin-level configuration changes; note this will also restrict legitimate admin configuration workflows. Additionally, audit existing user group names for unexpected HTML tags or JavaScript content as indicators of prior exploitation. Restrict admin-level access to the minimum required set of users, reducing the pool of accounts capable of injecting the payload.
Cayin CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials. Rated c
Multiple integer underflows in the icmLut_allocate function in International Color Consortium (ICC) Format library (iccl
phpKF CMS 3.00 Beta allows unauthenticated PHP file upload by disguising it as a PNG, then renaming it for execution. Po
Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 an
Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to ex
SQL injection vulnerability in hava_post.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbitr
Unrestricted file upload vulnerability in hava_upload.php in Havalite CMS 1.1.0 and earlier allows remote attackers to e
Cross-site request forgery (CSRF) vulnerability in Ilch CMS allows remote attackers to hijack the authentication of admi
Multiple cross-site scripting (XSS) vulnerabilities in Havalite 1.0.4 and earlier allow remote attackers to inject arbit
A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.
A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.
A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today