EUVD-2026-57447
GHSA-xh8r-pv2v-rc22
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stored XSS delivered over the network by a low-privilege user (PR:L, UI:R) with scope change into the victim's session enabling CSRF-based admin actions (S:C, C:L, I:L).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts can inject malicious JavaScript that executes in the browser of any higher-privileged user viewing the affected element, allowing account creation and other authenticated actions.
AnalysisAI
Stored XSS in Craft CMS's control panel allows a low-privilege author to execute arbitrary JavaScript in an administrator's authenticated session by injecting a malicious payload into a draft name, which is rendered without HTML encoding in element chips and cards. All Craft CMS installations running versions 5.0.0-RC1 through 5.10.8 (exclusive) are affected. An attacker who can create element drafts can harvest the administrator's CSRF token and issue privileged control-panel actions - including creating new administrator accounts - without the victim taking any action beyond routine browsing of element indexes or relation fields. No public exploit identified at time of analysis, though the vendor's GHSA advisory verified the account-creation impact end-to-end.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) describes the root cause: the server-side helper that renders element chips and cards writes the draftName field directly into HTML output without HTML entity encoding, despite correctly encoding surrounding path segments. Craft CMS is a PHP-based CMS distributed via Composer as craftcms/cms (CPE: cpe:2.3:a:craftcms:cms:*:*:*:*:*:*:*:*). The vulnerable rendering path is triggered in element indexes when drafts are visible, in relation and element-selection fields that reference a draft-carrying element, and in the drafts list - all routine control-panel UI surfaces. Craft CMS embeds a CSRF token (Craft.csrfTokenValue) directly in control-panel page JavaScript, making it trivially readable by any in-origin script. This is the third reported output-encoding gap in Craft CMS 5.x: GHSA-xrqc-p465-2xvg addressed structure entry titles and GHSA-3x4w-mxpf-fhqq addressed revision context menus, establishing a pattern of incremental encoding fixes in user-controlled label fields.
RemediationAI
Upgrade Craft CMS to version 5.10.8 or later via Composer: composer require craftcms/cms:^5.10.8. This is the vendor-released patch that introduces proper HTML encoding for the draftName field in the element chip/card rendering helper. The fix commit is https://github.com/craftcms/cms/commit/06c799148537ce960f6bc86e162b499947040eda and the advisory is at https://github.com/craftcms/cms/security/advisories/GHSA-2rp4-x2j7-qmcc. If immediate upgrade is not feasible, restrict control-panel accounts so that draft-creation permissions are granted only to explicitly trusted users - this removes the attacker's ability to store a payload, though it may constrain editorial workflows for organizations with contributor roles. Hiding drafts from element indexes for administrative users would reduce the exposure surface but would not eliminate it, since relation fields and element-selection fields also trigger the vulnerable rendering path.
Cayin CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials. Rated c
Multiple integer underflows in the icmLut_allocate function in International Color Consortium (ICC) Format library (iccl
phpKF CMS 3.00 Beta allows unauthenticated PHP file upload by disguising it as a PNG, then renaming it for execution. Po
Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 an
Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to ex
SQL injection vulnerability in hava_post.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbitr
Unrestricted file upload vulnerability in hava_upload.php in Havalite CMS 1.1.0 and earlier allows remote attackers to e
Cross-site request forgery (CSRF) vulnerability in Ilch CMS allows remote attackers to hijack the authentication of admi
Multiple cross-site scripting (XSS) vulnerabilities in Havalite 1.0.4 and earlier allow remote attackers to inject arbit
A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.
A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.
A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today