Description

Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject arbitrary JavaScript payloads in the site name that execute when other users view the control panel settings pages.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.8",
  "pubDate": "2026-09-02T12:17:15.820Z",
  "pubdate": "2026-09-02T12:17:15.820Z",
  "executiveSummary": "Craft CMS versions 5.0.0-RC1 through 5.10.10 are susceptible to a stored cross-site scripting (XSS) vulnerability located within the site name configuration field.\nThis vulnerability arises due to insufficient input sanitization of the site name attribute within the administrative control panel.\nAn authenticated attacker with administrative privileges can inject malicious JavaScript payloads into this field, which are subsequently stored in the application database.\nThe vulnerability poses a significant security risk, as the injected scripts are executed in the browser context of any other user who accesses the impacted control panel settings pages.\nThis allows for unauthorized actions, session hijacking, or administrative account takeover, depending on the victim's privileges.\nExploitation requires administrative access to the system configuration settings, limiting the attack vector to insiders or compromised administrative accounts.\nThe impact is rated as critical for administrative environments, as it bypasses standard security controls by leveraging the trust associated with the CMS dashboard.",
  "technicalDetails": "The vulnerability is rooted in the improper handling of user-supplied data in the Craft CMS site settings module. Specifically, the site name field fails to perform adequate output encoding or input sanitization before persisting the data to the application database.\nWhen an administrator updates the site name, the application processes the input and stores the raw string. Because the CMS does not implement a restrictive content security policy or context-aware output encoding when rendering this field in the administrative dashboard, the browser interprets any included HTML tags or JavaScript event handlers as active content.\nThe attack flow follows a structured path: First, an authenticated attacker navigates to the general settings section of the Craft CMS control panel. Second, the attacker modifies the site name field, injecting a malicious JavaScript payload, such as '<script>alert(document.cookie)</script>' or an asynchronous payload designed to exfiltrate session tokens to a remote server. Third, upon saving these settings, the payload is persisted in the database associated with the site configuration.\nThe execution phase occurs when any other user with access to the control panel, specifically those with permissions to view the site settings, triggers the rendering of the compromised configuration. When the dashboard page is loaded by the victim, the CMS injects the unsanitized site name value directly into the Document Object Model (DOM).\nConsequently, the browser executes the stored JavaScript within the security context of the victim's session. This grants the attacker the ability to perform actions on behalf of the victim, such as modifying other system configurations, creating new administrative accounts, or accessing sensitive environment data that may be exposed in the dashboard.\nThe vulnerability persists until the payload is manually removed from the database or the CMS is updated to implement proper sanitization libraries. The scope of the issue is restricted to the control panel area, but given the elevated permissions typically held by users of the dashboard, the potential for privilege escalation and full system compromise is high."
}