EUVD-2026-38177
GHSA-5w9j-w5p8-r4p7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Admin-only write access required (PR:H), victim must load the page (UI:R), and injected JavaScript executes in other users' browser contexts causing scope change (S:C).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Craft CMS contains a stored cross-site scripting (XSS) vulnerability in the editableTable.twig component when using the 'Row Heading' column type. The application fails to sanitize input within row heading default values, allowing an attacker with an administrator account (with allowAdminChanges enabled) to inject arbitrary JavaScript that executes when another user views a page containing the affected table field. Affected versions are >= 4.5.0-beta.1 through 4.16.18 and >= 5.0.0-RC1 through 5.8.22; fixed in 4.16.19 and 5.8.23.
AnalysisAI
Stored XSS in Craft CMS's Table field component allows an authenticated administrator to persist arbitrary JavaScript via the Row Heading column type's default values, executing in the browser of any subsequent user who views a page rendering the affected table field. Affected deployments span Craft CMS 4.5.0-beta.1 through 4.16.18 and 5.0.0-RC1 through 5.8.22; patches are available in 4.16.19 and 5.8.23. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, though the GHSA advisory published a working proof-of-concept payload, and real-world risk is substantially constrained by the non-default allowAdminChanges production setting.
Technical ContextAI
The vulnerability resides in the editableTable.twig template and the Table.php field class within Craft CMS (CPE: cpe:2.3:a:craftcms:cms). CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause: the _normalizeCellValue() method applied Html::encode() to the 'heading' column type during data normalization, but this encoding did not carry through to the HTML rendering path in _getInputHtml(). As shown in the patch diff (commit 7b372de262b8d9d2ce859f32780c3715719b6f5a), the fix removes the encode call from normalization and adds a match expression in _getInputHtml() that explicitly encodes $row[$colId] only when the column type is 'heading', ensuring sanitization occurs at the point of output rather than at an earlier pipeline stage where it was ineffective for stored values rendered later.
RemediationAI
Upgrade Craft CMS to version 4.16.19 (for 4.x installations) or 5.8.23 (for 5.x installations); the upstream fix is available at https://github.com/craftcms/cms/commit/7b372de262b8d9d2ce859f32780c3715719b6f5a, with the full advisory at https://github.com/craftcms/cms/security/advisories/GHSA-6j87-m5qx-9fqp. As a compensating control for deployments that cannot patch immediately, set allowAdminChanges to false in the production environment config - this eliminates the prerequisite for exploitation entirely, since the attacker cannot modify Table field definitions without this setting enabled; the trade-off is that all field and settings changes must be made in a non-production environment and deployed via config sync. Organizations should also audit administrator account membership, as reducing the number of accounts with full admin privileges directly limits the attack surface, regardless of patch status.
Cayin CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials. Rated c
Multiple integer underflows in the icmLut_allocate function in International Color Consortium (ICC) Format library (iccl
phpKF CMS 3.00 Beta allows unauthenticated PHP file upload by disguising it as a PNG, then renaming it for execution. Po
Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 an
Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to ex
SQL injection vulnerability in hava_post.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbitr
Unrestricted file upload vulnerability in hava_upload.php in Havalite CMS 1.1.0 and earlier allows remote attackers to e
Cross-site request forgery (CSRF) vulnerability in Ilch CMS allows remote attackers to hijack the authentication of admi
Multiple cross-site scripting (XSS) vulnerabilities in Havalite 1.0.4 and earlier allow remote attackers to inject arbit
A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.
A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.
A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today