Sign in
Deutsch English Español Polski
Low

Craft CMS Vulnerable to Stored XSS in Settings Names and Field Options

  • Disclosed: 03.03.2026
  • Updated: 11.10.2026 10:22

Overview of all XSS Reports

Multiple stored XSS vulnerabilities were found in Craft CMS. They were split into 4 reports as follows:

Report What's Vulnerable Why Separate
This Report (1) Multiple settings names Twig Template: _includes/forms/checkbox.twig
Report 2 Entry Types Name Twig Template: _includes/forms/editableTable.twig
Report 3 Card Attributes in Field Layout helpers/Cp.php
Report 4 (Commerce) Product Type Name Source in Commerce, sink in CMS - will report this one via Commerce GHSA

Reports 2, 3, and 4 are clearly distinct locations. For this report (Report 1), it was not clear whether to split or consolidate these 7 bugs. The bug report was consolidated and the final categorization should be left to the judgement of the user.

Note: This overview is only in this Report. Other reports only reference this one.

Summary

Stored XSS in multiple settings. Names/labels are rendered without sanitization via checkbox.twig template which uses {{ label|raw }}.

Affected Sources

# Source (injection point) Sink (where payload reflects)
1 Section Name (/admin/settings/sections) Entries field -> Sources checklist
2 Volume Name (/admin/settings/assets/volumes/{vol_id}) Assets field -> Sources checklist
3 User Group Name (/admin/settings/users/groups) Users field -> Sources, User permissions page
4 Global Set Name (/admin/settings/globals) User permissions page
5 Generated Fields Name (Volumes, Users, etc.) Card Attributes checkboxes
6 Checkboxes & Radio Buttons Field Option Label (/admin/settings/fields) User profile pages
7 Custom Sources Label (/admin/users -> Customize Sources) Users field -> Sources checklist

Proof of Concept

Required Permissions (Attacker)

Bugs 1-3: Section, Volume, User Group Names

  1. Log in as admin.
  2. Inject payload in one of these:
    • Settings -> Sections -> Create/edit section -> Name
    • Settings -> Assets -> Volumes -> Create/edit volume -> Name
    • Settings -> Users -> User Groups -> Create/edit group -> Name
  3. Set Name to:
html
<img src=x onerror="alert('XSS')">
  1. Save.
  2. Go to Settings -> Fields -> Create new field.
  3. To trigger the XSS payload: Set Field Type to "Entries" (for Sections), "Assets" (for Volumes), or "Users" (for User Groups). The alert fires when the Sources checkbox list renders.

Note: User Group Name also reflects on User permissions page under User Groups section (/admin/users/{id}/permissions).

Bug 4: Global Set Name

  1. Go to Settings -> Globals (/admin/settings/globals).
  2. Create/edit a Global Set, set Name to payload.
  3. Save.
  4. Go to Users -> Edit any user -> Permissions tab (/admin/users/{id}/permissions).
  5. Alert fires because our payload got rendered in the "Global Sets" permissions section without encoding/sanitization.

Bug 5: Generated Fields Name

  1. Go to Settings -> Assets -> Volumes -> Create/Edit a volume.
  2. Scroll to Generated Fields section.
  3. Add a field, set Name to payload:
html
<img src=x onerror="alert('XSS')">
  1. Save & Notice the alert. The payload renders in the Card Attributes checkbox list below it.

Bug 6: Checkboxes/Radio Buttons Option Label

  1. Go to Settings -> Fields (/admin/settings/fields).
  2. Create new field, set Field Type to "Checkboxes" or "Radio Buttons".
  3. In Field Options, add an option with Label set to payload.
  4. Save the field.
  5. Go to Settings -> Users -> User Profile Fields (/admin/settings/users/fields).
  6. Add the created field to the layout and save.
  7. Alert fires on any user profile page (/admin/users/{id}).

Bug 7: Custom Sources Label

  1. Go to Users (/admin/users).
  2. Click the three dots icon -> Customize Sources.
  3. Create a new custom source, set Label to payload.
  4. Save.
  5. Go to Settings -> Fields -> Create new field.
  6. Set Field Type to "Users".
  7. Alert fires in the Sources checkbox list.

Resources

https://github.com/craftcms/cms/commit/943152d2246b36f12adf161a03b8695b773d9276 https://github.com/craftcms/cms/commit/67780a778c6ec04e68e64a0b1177c168306144a2

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Composer package craftcms/cms >= 5.0.0-RC1, < 5.9.0-beta.1, >= 4.0.0-RC1, < 4.17.0-beta.1 5.9.0-beta.1, 4.17.0-beta.1

References

CVSS score -
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P
Weakness (CWE)
CWE-79
Platform
Composer
Package
craftcms/cms
Disclosed
03.03.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-4mgv-366x-qxvx - CC BY 4.0

Vulnerability history: craftcms/cms

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (127) in the archive
Total entries
127
First → latest
07.2021 08.2026
Without a fix
6
Exploited in attacks
4

Severity breakdown

  • Critical 9
  • High 41
  • Medium 65
  • Low 12

Disclosures per year

Severity:
  1. Craft CMS: Passkey login accepts replayed WebAuthn assertions
    Critical CVE-2026-72780 >= 5.0.0-RC1, < 5.10.5 5.10.5
  2. Craft CMS: Arbitrary user password reset leading to administrator account takeover
    High CVE-2026-72786 >= 5.0.0-RC1, < 5.10.8 5.10.8
  3. Craft CMS: Authenticated RCE through Twig sandbox escape
    High CVE-2026-72781 >= 5.0.0-RC1, < 5.10.7, >= 4.0.0-RC1, < 4.18.3 5.10.7, 4.18.3
  4. Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass
    High CVE-2026-72778 >= 5.0.0-RC1, < 5.10.6, >= 4.0.0-RC1, < 4.18.2 5.10.6, 4.18.2
  5. Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview
    High CVE-2026-56382 >= 5.5.0, < 5.9.14 5.9.14
  6. Craft CMS: Potential authenticated Remote Code Execution via referrer redirect
    High CVE-2026-55794 >= 5.9.0, < 5.10.0 5.10.0
  7. Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget
    High CVE-2026-55790 >= 5.0.0-RC1, < 5.9.23, >= 4.0.0-RC1, < 4.17.16 5.9.23, 4.17.16
  8. Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves
    High CVE-2026-50282 >= 5.0.0-RC1, < 5.9.21, >= 4.0.0-RC1, < 4.17.14 5.9.21, 4.17.14
  9. Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwrites existing elements
    High CVE-2026-50281 >= 5.7.0, < 5.9.21 5.9.21
  10. Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets
    High CVE-2026-50284 >= 5.0.0-RC1, < 5.9.22, >= 4.0.0-RC1, < 4.17.15 5.9.22, 4.17.15
  11. Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap
    High CVE-2026-50279 >= 5.0.0-RC1, < 5.9.21 5.9.21
  12. Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs
    Critical CVE-2026-55791 >= 5.0.0-RC1, < 5.10, >= 4.0.0-RC1, < 4.18 5.10, 4.18
  13. Craft CMS's Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure
    High CVE-2026-44012 >= 5.0.0-RC1, < 5.9.18 5.9.18
  14. Craft CMS has Potential Authenticated Remote Code Execution via Malicious Attached Behavior
    High CVE-2026-44011 >= 4.0.0, < 4.17.12, >= 5.0.0, < 5.9.18 4.17.12, 5.9.18
  15. Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure
    High CVE-2026-44010 >= 5.0.0, < 5.9.18, >= 4.0.0, < 4.17.12 5.9.18, 4.17.12
  16. Craft CMS is Vulnerable to Authenticated Remote Code Execution via Malicious Attached Behavior
    High CVE-2026-33157 >= 5.6.0, < 5.9.13 5.9.13
  17. Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()
    High CVE-2026-32267 >= 4.0.0-RC1, < 4.17.6, >= 5.0.0-RC1, < 5.9.12 4.17.6, 5.9.12
  18. Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController
    High CVE-2026-32264 >= 4.0.0-RC1, < 4.17.5, >= 5.0.0-RC1, < 5.9.11 4.17.5, 5.9.11
  19. Craft CMS vulnerable to behavior injection RCE via EntryTypesController
    High CVE-2026-32263 >= 5.6.0, < 5.9.11 5.9.11
  20. CraftCMS has an RCE vulnerability via relational conditionals in the control panel
    High CVE-2026-31857 >= 5.0.0-RC1, < 5.9.9, >= 4.0.0-beta.1, < 4.17.4 5.9.9, 4.17.4
  21. CraftCMS's `ElementSearchController` Affected by Blind SQL Injection
    High CVE-2026-31858 >= 5.0.0-RC1, < 5.9.9 5.9.9
  22. Craft CMS has unauthenticated activation email trigger with potential user enumeration
    High CVE-2026-29069 >= 5.0.0-RC1, < 5.9.0-beta.2, >= 4.0.0-RC1, < 4.17.0-beta.2 5.9.0-beta.2, 4.17.0-beta.2
  23. Craft CMS Vulnerable to Authenticated RCE via "craft.app.fs.write()" in Twig Templates
    Critical CVE-2026-28697 >= 5.0.0-RC1, < 5.9.0-beta.1, >= 4.0.0-RC1, < 4.17.0-beta.1 5.9.0-beta.1, 4.17.0-beta.1
  24. Craft CMS Vulnerable to Stored XSS in Settings Names and Field Options this entry
    Low CVE-2026-56393 >= 5.0.0-RC1, < 5.9.0-beta.1, >= 4.0.0-RC1, < 4.17.0-beta.1 5.9.0-beta.1, 4.17.0-beta.1
  25. Craft CMS has IDOR via GraphQL @parseRefs
    High CVE-2026-28696 >= 4.0.0-RC1, < 4.17.0-beta.1, >= 5.0.0-RC1, < 5.9.0-beta.1 4.17.0-beta.1, 5.9.0-beta.1
  26. Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding
    High CVE-2026-27127 >= 5.0.0-RC1, < 5.8.23, >= 3.5.0, < 4.16.19 5.8.23, 4.16.19
  27. Craft CMS Vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior
    High CVE-2026-25498 >= 5.0.0-RC1, < 5.8.22, >= 4.0.0-RC1, < 4.16.18 5.8.22, 4.16.18
  28. Craft CMS: GraphQL Asset Mutation Privilege Escalation
    High CVE-2026-25497 >= 5.0.0-RC1, < 5.9.0-beta.1, >= 4.0.0-RC1, < 4.17.0-beta.1 5.9.0-beta.1, 4.17.0-beta.1
  29. Craft CMS Vulnerable to SQL Injection in Element Indexes via `criteria[orderBy]`
    High CVE-2026-25495 >= 5.0.0-RC1, < 5.8.22, >= 4.0.0-RC1, < 4.16.18 5.8.22, 4.16.18
  30. Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior
    High CVE-2025-68455 >= 5.0.0-RC1, < 5.8.21, >= 4.0.0-RC1, < 4.16.17 5.8.21, 4.16.17
  31. Unauthenticated Craft CMS users can trigger a database backup
    High CVE-2025-68456 >= 5.0.0-RC1, < 5.8.21, >= 3.0.0, < 4.16.17 5.8.21, 4.16.17
  32. Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI
    High CVE-2025-46731 >= 4.0.0-RC1, < 4.14.13, >= 5.0.0-RC1, < 5.6.15 4.14.13, 5.6.15
  33. Craft CMS Allows Remote Code Execution
    Critical · 10.0 Exploited in attacks CVE-2025-32432 >= 3.0.0-RC1, < 3.9.15, >= 4.0.0-RC1, < 4.14.15, >= 5.0.0-RC1, < 5.6.17 3.9.15, 4.14.15, 5.6.17
  34. Craft CMS has a potential RCE with a compromised security key
    High · 8.0 Exploited in attacks CVE-2025-23209 >= 5.0.0-RC1, < 5.5.8, >= 4.0.0-RC1, < 4.13.8 5.5.8, 4.13.8
  35. Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled
    Critical · 9.8 Exploited in attacks CVE-2024-56145 >= 5.0.0-RC1, < 5.5.2, >= 4.0.0-RC1, < 4.13.2, >= 3.0.0, < 3.9.14 5.5.2, 4.13.2, 3.9.14
  36. Craft CMS vulnerable to Potential Remote Code Execution via missing path normalization & Twig SSTI
    High · 7.2 CVE-2024-52293 >= 4.0.0-RC1, < 4.12.2, >= 5.0.0-RC1, < 5.4.3 4.12.2, 5.4.3
  37. Craft CMS Arbitrary System File Read
    High · 7.7 CVE-2024-52292 >= 5.0.0-alpha.1, < 5.4.9, >= 3.5.13, < 4.12.8 5.4.9, 4.12.8
  38. Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution
    High · 8.4 CVE-2024-52291 >= 5.0.0-RC1, < 5.4.6, >= 4.0.0-RC1, < 4.12.5 5.4.6, 4.12.5
  39. Craft CMS SQL injection vulnerability via the GraphQL API endpoint
    Critical · 9.8 CVE-2024-37843 <= 3.7.31 no fix
  40. Craft CMS Feed-Me
    High · 7.5 CVE-2023-36260 < 4.6.2 4.6.2
  41. Craft CMS Remote Code Execution vulnerability
    Critical · 10.0 CVE-2023-41892 >= 4.0.0-RC1, < 4.4.15 4.4.15
  42. Craft CMS vulnerable to Remote Code Execution via validatePath bypass
    High · 7.2 CVE-2023-40035 >= 4.0.0-RC1, < 4.4.15, >= 3.0.0, < 3.8.15 4.4.15, 3.8.15
  43. Craft CMS vulnerable to Remote Code Execution via unrestricted file extension
    High · 7.2 CVE-2023-32679 >= 4.0.0, < 4.4.6 4.4.6
  44. CraftCMS allows remote attacker to execute arbitrary code via crafted script to Section parameter
    High · 8.8 CVE-2023-30130 <= 3.8.1 no fix
  45. Craft CMS discloses password hashes
    High · 7.5 CVE-2022-37783 >= 3.0.0, < 3.7.33 3.7.33
  46. Craft CMS possibility of brute force attempts
    Critical · 9.8 CVE-2019-15929 < 3.1.7 3.1.7
  47. Craft CMS Vulnerable to Server-Side Template Injection
    High · 7.2 CVE-2018-20465 <= 3.0.34 no fix
  48. Craft CMS PHP Code Injection Vulnerability
    High · 8.8 CVE-2018-3814 <= 2.6.3000 no fix
  49. Improper account password reset in Craft CMS
    High · 8.8 CVE-2022-29933 < 3.7.36 3.7.36
  50. CSV Injection Vulnerability
    High · 8.8 CVE-2021-41824 >= 3.4.0, < 3.7.14 3.7.14
  51. Craft CMS Remote Code Injection
    Critical · 9.8 CVE-2021-27903 < 3.6.7 3.6.7

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.