CVE-2026-109307: Craft CMS Control Panel XSS Vulnerability

CVE-2026-109307 Overview

CVE-2026-109307 is a DOM-based cross-site scripting (XSS) vulnerability [CWE-79] in Craft CMS 5 affecting versions 5.0.0 before 5.10.14. The flaw resides in the control panel login and two-factor authentication (2FA) verification flow. A user-controlled returnUrl parameter accepts javascript: URLs and passes them to client-side navigation routines. Attackers can lure a 2FA-enabled victim into opening a crafted /admin/login?verify=1 URL between password submission and TOTP verification. Successful exploitation executes attacker-supplied JavaScript in the authenticated control panel with the victim's permissions.

Critical Impact
Attacker-supplied JavaScript executes in the authenticated Craft CMS control panel context, enabling actions on behalf of the signed-in administrator.

Affected Products

Craft CMS 5.0.0 through 5.10.13
Craft CMS control panel login endpoint (/admin/login)
Craft CMS 2FA verification flow (verify=1)

Discovery Timeline

2026-10-12 - CVE-2026-109307 published to NVD
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-109307

Vulnerability Analysis

The vulnerability sits in the client-side navigation logic of the Craft CMS control panel login page. When a user submits valid credentials and 2FA is enabled, the application transitions to a TOTP verification step reached through /admin/login?verify=1. During this transition, the page reads a returnUrl value that the user controls through the request. The client-side code assigns this value to a navigation sink without validating the URL scheme. A javascript: URL supplied in returnUrl is executed as script in the origin of the Craft CMS control panel.

Root Cause

The root cause is improper neutralization of input during web page generation on the client side. The login flow trusts the returnUrl parameter and uses it directly in a DOM navigation operation. The parser accepts arbitrary URL schemes, including javascript:, instead of restricting to same-origin HTTP or HTTPS targets. Because the sink runs after the user has authenticated with a password but before TOTP is confirmed, injected script executes in the context of the pending authenticated session.

Attack Vector

Exploitation requires user interaction. An attacker crafts a URL to /admin/login?verify=1 with a returnUrl value containing a javascript: payload and delivers it through phishing, chat, or an attacker-controlled web page. The victim must be a Craft CMS user with 2FA enabled who clicks the link during the window between password submission and TOTP entry. The attacker does not need valid credentials, but social engineering is required to trigger the sink. See the GitHub Security Advisory GHSA-w5rh-mhxj-wr8r and the VulnCheck Advisory for Craft CMS for additional detail.

No verified exploit code is published for this CVE. The vulnerability is described in prose based on the referenced advisories.

Detection Methods for CVE-2026-109307

Indicators of Compromise

Access log entries for /admin/login or /admin/login?verify=1 containing a returnUrl parameter whose value starts with javascript:, data:, or other non-HTTP schemes.
URL-encoded variants of javascript: such as javascript%3A in query strings targeting the control panel.
Referer headers to admin pages originating from external, untrusted domains during active login sessions.

Detection Strategies

Inspect web server and reverse-proxy logs for unusual returnUrl values on the Craft CMS admin login endpoint.
Deploy a web application firewall rule that blocks requests to /admin/* where returnUrl does not resolve to a same-origin relative or absolute HTTP(S) URL.
Hunt for browser telemetry showing script execution originating from the login page immediately after a user clicked an external link.

Monitoring Recommendations

Alert on any administrator session where control panel actions follow within seconds of a login redirect that includes a non-standard returnUrl scheme.
Monitor outbound requests from admin browsers to attacker-controlled domains following visits to /admin/login?verify=1.
Review Content Security Policy (CSP) violation reports from the control panel origin for inline script or javascript: navigations.

How to Mitigate CVE-2026-109307

Immediate Actions Required

Upgrade Craft CMS to version 5.10.14 or later across all environments running affected 5.x releases.
Instruct administrators to avoid clicking links to /admin/login received through email, chat, or external sites until patching is complete.
Audit recent control panel activity for actions that do not match the responsible administrator's expected workflow.

Patch Information

Craft CMS 5.10.14 resolves the DOM-based XSS by restricting accepted returnUrl values to safe URL schemes. Refer to the GitHub Security Advisory GHSA-w5rh-mhxj-wr8r for the authoritative fix details and release notes.

Workarounds

Place the Craft CMS control panel behind a VPN or IP allowlist to reduce exposure to externally crafted login URLs.
Add a reverse-proxy rule that strips or rejects returnUrl parameters containing values beginning with javascript: or other non-HTTP schemes.
Enforce a strict Content Security Policy on the control panel origin that disallows inline script and javascript: URLs.

bash

# Example nginx rule to drop requests with javascript: in returnUrl
if ($arg_returnUrl ~* "^(javascript|data|vbscript):") {
    return 400;
}