DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

GHSA-2RP4-X2J7-QMCC: GHSA-2RP4-X2J7-QMCC: Stored Cross-Site Scripting via Draft Names in Craft CMS Control Panel

#security #cve #cybersecurity #ghsa

GHSA-2RP4-X2J7-QMCC: Stored Cross-Site Scripting via Draft Names in Craft CMS Control Panel

Vulnerability ID: GHSA-2RP4-X2J7-QMCC
CVSS Score: 8.2
Published: 2026-08-06

An authenticated stored Cross-Site Scripting (XSS) vulnerability exists in the Control Panel helper of Craft CMS before version 5.10.8. Due to lack of HTML entity encoding within the elementLabelHtml method, unescaped draft names are rendered directly into administrative interfaces.

TL;DR

Craft CMS control panel is vulnerable to stored XSS via draft names because Yii's Html::tag helper does not auto-encode input, allowing authenticated authors to execute arbitrary JavaScript in administrators' browsers.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-79
  • Attack Vector: Network (AV:N)
  • CVSS v3.1 Score: 8.2 (High)
  • Exploit Status: Proof of Concept
  • Vulnerability Type: Stored Cross-Site Scripting (XSS)
  • Affected Component: src/helpers/Cp.php (elementLabelHtml method)

Affected Systems

  • Craft CMS Control Panel
  • Craft CMS: < 5.10.8 (Fixed in: 5.10.8)

Code Analysis

Commit: 06c7991

Ensure draft names are HTML-encoded in Cp::elementLabelHtml()

Mitigation Strategies

  • Upgrade Craft CMS installations to version 5.10.8 or newer immediately to ensure proper output encoding of draft names.
  • Implement a strong Content Security Policy (CSP) header that restricts inline script execution to limit the impact of stored script elements.
  • Deploy Web Application Firewall (WAF) rules designed to filter out HTML injection patterns in Control Panel requests.

Remediation Steps:

  1. Open a terminal in the project directory of the affected Craft CMS installation.
  2. Run the command 'composer update craftcms/cms' to pull down the latest patched security releases.
  3. Validate the update by ensuring the package version in composer.lock matches 5.10.8 or above.
  4. Verify that visual draft markers render as raw text and represent safe HTML entities when updated with standard markup tags.

References

Read the full report for GHSA-2RP4-X2J7-QMCC on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)