Craft CMS EUVD-2026-81290

Exploitation requires the Generated Fields feature to be in use on element(s) exposed via an element index, since that feature is what disables Twig autoescaping and stores un-encoded cached values. The attacker must hold a Craft CMS account with content-editor privileges able to write to a field that feeds a Generated Field (PR:L - not remote-unauthenticated). Execution is gated on user interaction: a higher-privileged Control Panel user must view the element index containing the injected payload (UI:P). Impact is confined to the victim's authenticated CP browser session (script execution as that user); the Craft server/data has no direct confidentiality, integrity, or availability impact. Limiting factors: need for a valid editor account, dependence on the optional Generated Fields feature, and required victim interaction all reduce realistic exploitability below the raw network-vector implication.

This is a genuine but modest-severity stored XSS, not a top-priority emergency. The vendor CVSS 4.0 score of 5.1 (medium) is well-calibrated: it correctly credits network vector (AV:N) and low complexity (AC:L) but limits impact via PR:L (attacker must already hold a content-editor account) and UI:P (a higher-privileged victim must actively view an affected element index). Notably, the vulnerable system itself takes no impact (VC:N/VI:N/VA:N); the only impact is on the subsequent system - the victim's authenticated Control Panel browser session (SC:L/SI:L). No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence, so there is no signal of active or imminent exploitation - the exploitation status is 'no public exploit identified at time of analysis.' All signals are internally consistent (medium CVSS, no exploitation evidence, privilege- and interaction-gated), so priority should be routine patching to 5.10.13 rather than emergency response. The main residual risk is privilege escalation: a low-trust content editor abusing an admin's session, which matters most in Craft deployments with many semi-trusted editors.

A low-privileged content editor enters a malicious JavaScript payload into an editable field that feeds a Generated Field; because the feature disables Twig autoescaping and stores the value un-encoded in cache, the script is served verbatim. When a higher-privileged administrator later opens the element index containing that entry, the payload executes inside the admin's authenticated Control Panel session, enabling actions as that admin. No public exploit code is identified at time of analysis.