GitHub Advisoryadvisory · Packagist

GHSA-7pr4-wx9w-mqwr Craft CMS Vulnerable to Stored XSS in Entry Types Name

LOW Published 2026-02-09 Modified 2026-02-09 Official page ↗
Aliases
CVE-2026-25491
Ecosystem
Packagist
Packages
craftcms/cms
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weaknesses
CWE-79
Reviewed
2026-02-09

Affected packages

• Packagist craftcms/cms: >= 5.0.0-RC1, < 5.8.22 → fixed in 5.8.22

Description

Summary Stored XSS via Entry Type names. The name is not sanitized when displayed in the Entry Types list. --- Proof of Concept Required Permissions (Attacker) • Admin access (only admins have access to the settings page) • `allowAdminChanges` is enabled in production, which is against our security recommendations. Steps to Reproduce 1. Log in as an attacker. 2. Go to Settings -> Entry Types (`/admin/settings/entry-types`). 3. Create a new Entry Type. 4. Set Name to: ```html ``` 5. Save the Entry Type, and you’ll be redirected back to the entry types table automatically. 6. Notice the alert fires when the entry types table renders.

Related

Alias · CVE (1)

  • CVE-2026-25491 Craft is a platform for creating digital experiences. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References