CVE-2026-56393: Craft CMS Stored XSS in Admin Configuration Fields (4.x, 5.x)

Technical summary

Craft CMS versions 4.x before 4.17.0-beta.1 and 5.x before 5.9.0-beta.1 contain multiple stored XSS vulnerabilities (CWE-79) across several administrative configuration surfaces. The root cause is the use of the `|raw` filter in Twig templates (e.g., checkbox.twig rendering `{{ label|raw }}`) without prior HTML sanitization. An authenticated administrator with allowAdminChanges enabled can inject arbitrary JavaScript into section names, volume names, user group names, global set names, generated field names, checkbox/radio option labels, and custom source labels. The payload is stored in the database and executed in the browsers of any administrator viewing the affected settings, regardless of whether they have permission to modify them. The attack vector is network-based, requires high privilege (admin role), and depends on user interaction (target admin must view the infected setting), yielding a CVSS score of 4.8 (Medium).

Business impact

For organizations running Craft CMS as a headless CMS or website platform, a malicious admin can compromise the sessions and credentials of other admins without additional attacks. This enables lateral privilege escalation, deletion of content, unauthorized API access, or defacement. The risk is elevated in multi-tenant or agency environments where admins from different teams access the same instance. In compliance-sensitive sectors, stored XSS in admin panels can violate data protection obligations if it leads to unauthorized data access or modification.

Affected systems

Craft CMS 4.x versions from 4.0.0-RC1 up to and including 4.16.x are vulnerable. Craft CMS 5.x versions from 5.0.0-RC1 up to and including 5.8.x are vulnerable. Craft CMS 4.17.0-beta.1 and Craft CMS 5.9.0-beta.1 and later versions are patched. Users running 4.17.0 GA (when released) and 5.9.0 GA will be protected. Earlier stable and RC releases require immediate patching.

Exploitability

Exploitation requires valid admin credentials with allowAdminChanges permission enabled—a relatively high barrier. However, once an admin is compromised or turns malicious, weaponization is trivial: they simply type a payload into any configuration field. No special tooling, unusual network access, or user social engineering is required. The stored nature of the XSS means the attack is repeatable and affects all subsequent visitors to the infected setting. The UI/R component (user interaction) is low friction in a control panel context, as admins routinely inspect settings.

Remediation

Upgrade Craft CMS 4.x instances to 4.17.0-beta.1 or later (verify against the Craft CMS release page for GA availability); upgrade Craft CMS 5.x instances to 5.9.0-beta.1 or later. If immediate upgrades are not feasible, restrict the allowAdminChanges permission to a minimal, trusted subset of admins and conduct an audit of configuration fields for suspicious payloads. After patching, admins should review recent changes to section/volume/group/field names and labels for evidence of injection.

Patch guidance

Craft CMS provides patched versions at 4.17.0-beta.1 for the 4.x branch and 5.9.0-beta.1 for the 5.x branch. Users should download directly from the official Craft CMS website or upgrade via Composer. Beta versions are considered release candidates; verify that your deployment process and tests cover these versions. Once GA versions are released, plan a migration to those stable releases. Test patches thoroughly in a staging environment before deploying to production, particularly to validate that custom Twig templates or plugins do not rely on the |raw filter in untrusted contexts.

Detection guidance

Search your Craft database for suspicious patterns in configuration tables (sections, volumes, user groups, global sets, fields, and custom sources). Look for JavaScript patterns such as <script>, onerror=, onload=, onclick=, or other event handlers in field names and labels. Implement database integrity monitoring on tables that store admin-modifiable configuration. Monitor control-panel access logs for unusual read patterns (an attacker may probe for successful injection points). Consider deploying a WAF or XSS-filtering reverse proxy in front of the Craft control panel, though this is not a substitute for patching. Review admin audit logs for unauthorized configuration changes.

Why prioritize this

Although the CVSS score is 4.8 (Medium), the vulnerability warrants prompt patching because (1) it affects the administrative control panel directly, (2) it enables session hijacking and privilege escalation, (3) stored XSS can persist across multiple sessions and is difficult to clean up without inspection, and (4) it requires only admin credentials, not zero-day exploitation. Prioritize this higher than the CVSS alone suggests if your organization has multi-admin teams or shared hosting environments.

Risk score, explained

CVSS 3.1 score of 4.8 reflects Network attack vector, Low complexity, High privilege requirement, and Required user interaction. Confidentiality and Integrity impact are both Low (an attacker can view other admins' data and modify content in their context, but cannot directly delete data or escalate to system-level compromise). Availability is None. The High privilege barrier (admin role) and Required user interaction (target admin must view the setting) suppress the score despite the stored nature of the XSS. In practice, the risk may be higher in organizations with compromised or malicious admins; adjust your risk appetite accordingly.

Frequently asked questions