CVE-2026-31859 Details
Description
Craft is a content management system (CMS). The fix for CVE-2025-35939 in craftcms/cms introduced a strip_tags() call in src/web/User.php to sanitize return URLs before they are stored in the session. However, strip_tags() only removes HTML tags (angle brackets) -- it does not inspect or filter URL schemes. Payloads like javascript:alert(document.cookie) contain no HTML tags and pass through strip_tags() completely unmodified, enabling reflected XSS when the return URL is rendered in an href attribute. This vulnerability is fixed in 5.9.7 and 4.17.3.
A reflected cross-site scripting vulnerability has been identified in Craft CMS versions 4.15.3 through 4.17.2 and 5.7.5 through 5.9.6. The issue arises from inadequate sanitization of return URLs before they are stored in the session. Although a `strip_tags()` function was introduced to remove HTML tags, it fails to filter URL schemes. This oversight allows malicious payloads, such as `javascript:` URLs, to bypass the sanitization and execute scripts when the URL is rendered in an `href` attribute. The vulnerability is exploited by crafting a link with a harmful return URL that, once clicked, executes the embedded JavaScript in the context of the Craft CMS site.
Users can update to Craft CMS version 5.9.7 or 4.17.3, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/craftcms/cms/security/advisories/GHSA-fvwq-45qv-xvhv | [email protected] | PatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-116 | Improper Encoding or Escaping of Output | [email protected] |
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| craftcms craft cms | >= 4.15.3, < 4.17.3 >= 5.7.5, < 5.9.7 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 17, 2026 | Initial Analysis | [email protected] |
| Mar 11, 2026 | New CVE Received | [email protected] |