Description

Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts can inject malicious JavaScript that executes in the browser of any higher-privileged user viewing the affected element, allowing account creation and other authenticated actions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-12T20:17:49.977Z",
  "pubdate": "2026-08-12T20:17:49.977Z",
  "executiveSummary": "This security assessment evaluates a stored cross-site scripting vulnerability present within Craft CMS versions prior to 5.10.8. The vulnerability manifests in the administration control panel where draft names are rendered dynamically without adequate HTML encoding when displayed inside element chips and cards. This security defect introduces severe risk implications for administrative integrity and session security across the affected web application. An authenticated attacker possessing low-level privileges capable of generating element drafts can leverage this flaw to inject arbitrary malicious JavaScript payloads. When a higher-privileged user or system administrator accesses the affected control panel interface and views the compromised element, the injected script executes automatically within the context of their active browser session. This successful exploitation flow grants the malicious actor the capability to perform unauthorized authenticated actions, including the creation of rogue administrator accounts and subsequent full system takeover. Exploitation requires authenticated access with permissions sufficient to create element drafts, combined with social engineering or administrative interaction that causes a higher-privileged user to view the malicious draft representation within the dashboard interface.",
  "technicalDetails": "The root cause of this vulnerability stems from improper output sanitization and the absence of contextual HTML encoding within the Craft CMS control panel component responsible for rendering element draft identifiers. Specifically, when element chips and cards are populated with draft names retrieved from the database, the application fails to neutralize special HTML characters such as angle brackets and quotation marks. Consequently, arbitrary user-supplied input provided during the draft creation process is treated as executable markup rather than inert string data when processed by the Document Object Model.\nThe exploitation method relies on stored cross-site scripting vectors. An attacker initiates the attack flow by authenticating to the Craft CMS platform with low privileges, specifically utilizing capabilities that permit the creation of element drafts. During the draft naming phase, the attacker inputs a crafted payload containing malicious JavaScript encapsulated within standard HTML execution tags, such as script elements or event handlers embedded in markup attributes. This payload is subsequently stored persistently within the application database without validation or sanitization.\nThe attack flow reaches its culmination when a higher-privileged user, such as an administrator, navigates to the control panel interface where the malicious element draft is rendered as a chip or card. As the application constructs the user interface, it injects the unescaped draft name directly into the HTML response or DOM tree. The victim browser parses the incoming response, interprets the attacker-supplied payload as legitimate code, and executes the embedded JavaScript under the privileges of the victim session.\nThe post-exploitation impact is severe due to the execution context. Because the script runs within the authenticated session of a high-privileged user, it can interact directly with the DOM, make asynchronous API requests on behalf of the victim, extract sensitive session tokens, or execute unauthorized administrative mutations. This enables the attacker to automate critical actions such as provisioning new high-privilege user accounts, modifying global application configurations, or deploying further persistence mechanisms within the environment. The vulnerable component resides within the Craft CMS control panel rendering engine affecting all software iterations prior to version 5.10.8."
}