GitStock

craftcms/cms · Security

Craft CMS Vulnerable to Stored XSS in Entry Types Name

GHSA ID
GHSA-7pr4-wx9w-mqwr
CVE ID
CVE-2026-25491
Severity
low
Published
Updated
CVSS v4
1.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Description

Summary

Stored XSS via Entry Type names. The name is not sanitized when displayed in the Entry Types list.

Proof of Concept

Required Permissions (Attacker)

  • Admin access (only admins have access to the settings page)
  • allowAdminChanges is enabled in production, which is against our security recommendations.

Steps to Reproduce

  1. Log in as an attacker.
  2. Go to Settings -> Entry Types (/admin/settings/entry-types).
  3. Create a new Entry Type.
  4. Set Name to:
<img src=x onerror="alert('XSS-EntryTypes')" hidden>
  1. Save the Entry Type, and you’ll be redirected back to the entry types table automatically.
  2. Notice the alert fires when the entry types table renders.

CWEs

  • CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

References

Open GitHub