CVE-2026-25491
📋 TL;DR
CVE-2026-25491 is a stored cross-site scripting (XSS) vulnerability in Craft CMS that allows attackers to inject malicious scripts via Entry Type names. These scripts execute when administrators view the Entry Types list, potentially compromising admin sessions. All Craft CMS installations from version 5.0.0-RC1 through 5.8.21 are affected.
💻 Affected Systems
- Craft CMS
📦 What is this software?
Craft Cms by Craftcms
⚠️ Risk & Real-World Impact
Worst Case
Administrator account takeover leading to full system compromise, data theft, or website defacement.
Likely Case
Session hijacking of admin users, unauthorized actions within the CMS, or credential theft.
If Mitigated
Limited impact if only trusted users can create Entry Types and admin sessions are properly secured.
🎯 Exploit Status
Exploitation requires authenticated access with Entry Type creation/modification permissions. The vulnerability is straightforward to exploit once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.8.22
Vendor Advisory: https://github.com/craftcms/cms/security/advisories/GHSA-7pr4-wx9w-mqwr
Restart Required: No
Instructions:
1. Backup your Craft CMS installation and database. 2. Update Craft CMS to version 5.8.22 or later via Composer: 'composer require craftcms/cms:^5.8.22'. 3. Clear caches if necessary. 4. Verify the update completed successfully.
🔧 Temporary Workarounds
Restrict Entry Type Management
allTemporarily remove Entry Type creation/modification permissions from all non-essential users.
Input Validation Filter
allImplement server-side filtering to sanitize Entry Type names before storage.
🧯 If You Can't Patch
- Restrict Entry Type management to only essential, trusted administrators.
- Implement Content Security Policy (CSP) headers to mitigate XSS impact.
🔍 How to Verify
Check if Vulnerable:
Check Craft CMS version in admin panel or via 'composer show craftcms/cms' command.Check Version:
composer show craftcms/cms | grep versionsVerify Fix Applied:
Confirm version is 5.8.22 or later and test that HTML/script tags in Entry Type names are properly escaped.📡 Detection & Monitoring
Log Indicators:
- Unusual Entry Type creation/modification logs
- Admin session anomalies
Network Indicators:
- Suspicious JavaScript payloads in HTTP requests to Entry Type endpoints
SIEM Query:
source="craft_logs" AND (event="entry_type_created" OR event="entry_type_updated") AND data.name CONTAINS "<script>"