CVE-2026-56393 Details
Description
Craft CMS 4.x (>= 4.0.0-RC1, < 4.17.0-beta.1) and 5.x (>= 5.0.0-RC1, < 5.9.0-beta.1) contain multiple stored cross-site scripting vulnerabilities where settings names and field option labels are rendered without sanitization (e.g., via the checkbox.twig template, which used {{ label|raw }}). An authenticated administrator (with allowAdminChanges enabled) can inject malicious payloads into section names, volume names, user group names, global set names, generated field names, checkbox/radio option labels, and custom source labels, causing arbitrary JavaScript to execute in other users' control-panel sessions. Fixed in 4.17.0-beta.1 and 5.9.0-beta.1.
A stored cross-site scripting vulnerability has been identified in Craft CMS versions 4.x (from 4.0.0-RC1 to prior to 4.17.0-beta.1) and 5.x (from 5.0.0-RC1 to prior to 5.9.0-beta.1). This vulnerability arises because various settings names and field option labels are rendered without proper sanitization, allowing an authenticated administrator with 'allowAdminChanges' enabled to inject malicious scripts. These scripts are executed in the control panel sessions of other users. The vulnerability can be exploited by injecting payloads into section names, volume names, user group names, global set names, generated field names, checkbox or radio option labels, and custom source labels.
Users can update to Craft CMS versions 4.17.0-beta.1 or 5.9.0-beta.1, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 21, 2026CISA-ADP
Assessed Jun 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/craftcms/cms/security/advisories/GHSA-4mgv-366x-qxvx | CISA-ADP | AdvisoryBundleExploitRemedyVendor |
| https://github.com/craftcms/cms/commit/67780a778c6ec04e68e64a0b1177c168306144a2 | [email protected] | Source CodeVendor |
| https://github.com/craftcms/cms/commit/943152d2246b36f12adf161a03b8695b773d9276 | [email protected] | Source CodeVendor |
| https://github.com/craftcms/cms/security/advisories/GHSA-4mgv-366x-qxvx | [email protected] | AdvisoryBundleExploitRemedyVendor |
| https://www.vulncheck.com/advisories/craft-cms-multiple-stored-cross-site-scripting-in-settings-names-and-field-options | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Craft CMS | >= 4.0.0-RC1, < 4.17.0-beta.1 (semver) >= 5.0.0-RC1, < 5.9.0-beta.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 22, 2026 | CVE Modified | CISA-ADP |
| Jun 21, 2026 | New CVE Received | [email protected] |