Craft CMS Vulnérable à une XSS stockée dans le nom des types d'entrée

The primary impact of CVE-2026-25491 is the potential for an attacker to execute arbitrary JavaScript code within the context of a user's browser. This could lead to session hijacking, credential theft, redirection to malicious websites, or defacement of the Craft CMS administration interface. Because the vulnerability resides within the admin panel, the attacker needs admin privileges. The allowAdminChanges setting, if enabled, significantly increases the risk by allowing changes to be made in production environments, bypassing typical development and testing workflows. This vulnerability is similar to other XSS vulnerabilities where user-supplied input is not properly sanitized before being displayed.

Organizations using Craft CMS in production environments, particularly those with admin users who may inadvertently enable the allowAdminChanges setting, are at risk. Shared hosting environments where multiple users share the same Craft CMS instance are also vulnerable, as an attacker could potentially compromise an admin account and exploit the vulnerability.

• php: Examine Craft CMS logs for POST requests to /admin/settings/entry-types containing suspicious HTML or JavaScript code in the Name parameter. Use grep to search for patterns like <script> or onerror= within log entries.

grep '<script>.*onerror=' /path/to/craftcms/storage/logs/web.log

• generic web: Monitor access logs for requests to /admin/settings/entry-types originating from unusual IP addresses or user agents. Check response headers for unexpected content or redirects.

curl -I https://example.com/admin/settings/entry-types | grep Content-Type

1. 2026-02-09Disclosure

   disclosure

1. Réservé2026-02-02
2. Publiée2026-02-09
3. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2026-25491 is to upgrade Craft CMS to version 5.8.22 or later, which includes the necessary fix. If upgrading immediately is not feasible, disable the allowAdminChanges setting in production. This will prevent changes to the CMS configuration in a live environment. As a temporary workaround, implement strict input validation and output encoding on the Entry Type name field using a web application firewall (WAF) or proxy. Monitor Craft CMS logs for suspicious activity, particularly attempts to create or modify Entry Types with unusual characters or HTML tags. After upgrading, confirm the fix by attempting to create an Entry Type with a malicious name (e.g., <script>alert('XSS')</script>) and verifying that the script is not executed.

Dernière mise à jour

5.10.3récemment