CVE-2026-25491: XSS in Craft CMS 5.8.9 and Below

The primary impact of CVE-2026-25491 is the potential for an attacker to execute arbitrary JavaScript code within the context of a user's browser. This could lead to session hijacking, credential theft, redirection to malicious websites, or defacement of the Craft CMS administration interface. Because the vulnerability resides within the admin panel, the attacker needs admin privileges. The allowAdminChanges setting, if enabled, significantly increases the risk by allowing changes to be made in production environments, bypassing typical development and testing workflows. This vulnerability is similar to other XSS vulnerabilities where user-supplied input is not properly sanitized before being displayed.

1. Reserved2026-02-02
2. Published2026-02-09
3. EPSS updated2026-03-23

The primary mitigation for CVE-2026-25491 is to upgrade Craft CMS to version 5.8.22 or later, which includes the necessary fix. If upgrading immediately is not feasible, disable the allowAdminChanges setting in production. This will prevent changes to the CMS configuration in a live environment. As a temporary workaround, implement strict input validation and output encoding on the Entry Type name field using a web application firewall (WAF) or proxy. Monitor Craft CMS logs for suspicious activity, particularly attempts to create or modify Entry Types with unusual characters or HTML tags. After upgrading, confirm the fix by attempting to create an Entry Type with a malicious name (e.g., <script>alert('XSS')</script>) and verifying that the script is not executed.