Craft CMS EUVD-2026-69905

Exploitation requires the attacker to hold an active administrator-level account on the target Craft CMS 5.x installation - no lower-privilege role can modify the site name field. The payload is triggered only when a second user with access to the control panel settings pages displaying the site name visits those pages; front-end visitors and non-panel users are unaffected. The vulnerability is constrained to Craft CMS 5.0.0-RC1 through 5.10.10; earlier major versions are outside the stated scope. Multi-administrator environments or shared hosting panels present the most realistic attack surface.

The CVSS 4.0 score of 4.8 (Medium) accurately reflects the constrained threat model: exploitation unconditionally requires an attacker-controlled administrator account (PR:H), and payload delivery depends on a second privileged user visiting the affected settings page (UI:P). In single-administrator or tightly controlled deployments, the realistic exploitability approaches zero. In multi-admin environments or SaaS-style Craft hosting where different clients share admin roles, the risk is meaningfully higher - a rogue or compromised admin could leverage session hijacking to achieve lateral privilege escalation across other admin accounts. No EPSS score is provided in the input, KEV status is not confirmed, and no public POC has been identified, consistent with the low CVSS score. The vulnerability is narrowly scoped to the Craft 5.x line (5.0.0-RC1 onward) and a direct vendor fix is available.

An attacker with a compromised or rogue administrator account navigates to the Craft CMS control panel, edits the site name field to embed a JavaScript payload such as a document.cookie exfiltration script pointing to an attacker-controlled server, and saves the settings. When a second administrator or privileged panel user visits any control panel settings page that renders the site name, the script executes in their browser, forwarding their session token to the attacker who can then impersonate that user. No public POC has been identified, but the technique is trivially constructable from the description.