CVE-2026-56393

{
  "id": "CVE-2026-56393",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-21T14:16:26.277",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Craft CMS 4.x (>= 4.0.0-RC1, < 4.17.0-beta.1) and 5.x (>= 5.0.0-RC1, < 5.9.0-beta.1) contain multiple stored cross-site scripting vulnerabilities where settings names and field option labels are rendered without sanitization (e.g., via the checkbox.twig template, which used {{ label|raw }}). An authenticated administrator (with allowAdminChanges enabled) can inject malicious payloads into section names, volume names, user group names, global set names, generated field names, checkbox/radio option labels, and custom source labels, causing arbitrary JavaScript to execute in other users' control-panel sessions. Fixed in 4.17.0-beta.1 and 5.9.0-beta.1."
    },
    {
      "lang": "es",
      "value": "Craft CMS 4.x (>= 4.0.0-RC1, anterior a 4.17.0-beta.1) y 5.x (>= 5.0.0-RC1, anterior a 5.9.0-beta.1) contienen múltiples vulnerabilidades de cross-site scripting almacenado donde los nombres de las configuraciones y las etiquetas de las opciones de campo se renderizan sin sanitización (por ejemplo, a través de la plantilla checkbox.twig, que utilizaba {{ label|raw }}). Un administrador autenticado (con allowAdminChanges habilitado) puede inyectar cargas útiles maliciosas en nombres de secciones, nombres de volúmenes, nombres de grupos de usuarios, nombres de conjuntos globales, nombres de campos generados, etiquetas de opciones de casilla de verificación/radio y etiquetas de fuentes personalizadas, causando que JavaScript arbitrario se ejecute en las sesiones del panel de control de otros usuarios. Corregido en 4.17.0-beta.1 y 5.9.0-beta.1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "craftcms",
          "product": "cms",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:composer/craftcms/cms",
          "versions": [
            {
              "version": "5.0.0-RC1",
              "lessThan": "5.9.0-beta.1",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "5.9.0-beta.1",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "4.0.0-RC1",
              "lessThan": "4.17.0-beta.1",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "4.17.0-beta.1",
              "versionType": "semver",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 4.6,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "HIGH",
          "userInteraction": "ACTIVE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "LOW",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "LOW",
          "subIntegrityImpact": "LOW",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 4.8,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.7,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-22T13:21:37.669665Z",
          "id": "CVE-2026-56393",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/craftcms/cms/commit/67780a778c6ec04e68e64a0b1177c168306144a2",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/craftcms/cms/commit/943152d2246b36f12adf161a03b8695b773d9276",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/craftcms/cms/security/advisories/GHSA-4mgv-366x-qxvx",
      "source": "[email protected]"
    },
    {
      "url": "https://www.vulncheck.com/advisories/craft-cms-multiple-stored-cross-site-scripting-in-settings-names-and-field-options",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/craftcms/cms/security/advisories/GHSA-4mgv-366x-qxvx",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}