CVE-2026-55793: Craft CMS Stored XSS Vulnerability

CVE-2026-55793 Overview

CVE-2026-55793 is a stored cross-site scripting (XSS) vulnerability in Craft CMS, an open-source content management system. The flaw affects versions 5.0.0-RC1 through 5.9.22 and allows an author-level control panel user to store a JavaScript payload in an entry title. The payload executes when an administrator or another user with saveEntries permission drags an entry beneath the poisoned entry in the table view. Craft CMS released a fix in version 5.9.23. The weakness maps to CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
A low-privileged author can hijack an elevated admin session, enabling account takeover and unauthorized modification of site content.

Affected Products

Craft CMS versions 5.0.0-RC1 through 5.9.22
Control panel table view component (ElementTableSorter.js)
Structure sections shared between author-level and admin-level accounts

Discovery Timeline

2026-07-01 - CVE-2026-55793 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-55793

Vulnerability Analysis

The vulnerability is a stored XSS in the Craft CMS control panel structure section table view. An attacker with an Author-role account creates an entry whose title contains a JavaScript payload. The server escapes the title into a data-title HTML attribute, which the browser then decodes when parsing the DOM. Client-side JavaScript retrieves the value with jQuery .data('title') and concatenates it into a new HTML string without re-escaping attribute contents. The payload executes in the victim's browser under the victim's session context when a drag operation triggers the ancestor toggle button creation.

Root Cause

The root cause is unsafe string concatenation in src/web/assets/cp/src/js/ElementTableSorter.js. The original code built a <button> element via string interpolation, embedding ancestorTitle directly into title and aria-label attribute values. Because jQuery .data() returns the browser-decoded string, any prior HTML-entity encoding is lost before the value is placed back into markup, defeating the initial escaping.

Attack Vector

Exploitation requires three preconditions. The attacker needs an authenticated control panel account with at least the Author role. The victim must hold saveEntries permission for the same Structure section and must actively perform a drag operation on another entry beneath the poisoned entry. The victim's session must be elevated at trigger time for the payload to reach sensitive administrative functionality.

javascript

// Patch from src/web/assets/cp/src/js/ElementTableSorter.js
// Vulnerable pattern (removed) used string concatenation of ancestorTitle
// Fixed pattern uses jQuery attribute object, which escapes attribute values safely
         if (this._updateAncestors._$ancestor.data('descendants') == 1) {
           // Create its toggle
           const ancestorTitle = this._updateAncestors._$ancestor.data('title');
-          $(
-            '<button class="toggle expanded" type="button" aria-expanded="true" title="' +
-              Craft.t('app', 'Show/hide children') +
-              '" aria-label="' +
-              Craft.t('app', 'Show {title} children', {title: ancestorTitle}) +
-              '"></button>'
-          ).insertAfter(
+          $('<button/>', {
+            class: 'toggle expanded',
+            type: 'button',
+            'aria-expanded': 'true',
+            title: Craft.t('app', 'Show/hide children'),
+            'aria-label': Craft.t('app', 'Show {title} children', {
+              title: ancestorTitle,
+            }),
+          }).insertAfter(
             this._updateAncestors._$ancestor.find('> th .move:first')
           );
         }

Source: Craft CMS commit 162321e

Detection Methods for CVE-2026-55793

Indicators of Compromise

Entry titles in the entries table containing HTML tags, event handlers such as onerror= or onmouseover=, or javascript: URIs
Control panel access log entries showing Author-role accounts creating or updating entries followed by admin drag operations in the same Structure section
Unexpected outbound requests from admin browsers to attacker-controlled domains after control panel sessions

Detection Strategies

Audit stored entry titles for characters and patterns inconsistent with normal editorial content, including <, >, ", and known XSS sinks
Review Craft CMS audit logs for entries created by low-privileged authors that were later reorganized by administrators
Deploy a Content Security Policy in report-only mode and monitor violations originating from the /admin control panel path

Monitoring Recommendations

Alert on admin control panel sessions that generate anomalous XHR or fetch calls to external hosts
Track privilege changes, API token creation, and user account additions that occur within minutes of admin drag interactions
Correlate web server logs with Craft CMS activity logs to identify author accounts that repeatedly modify entries with suspicious title content

How to Mitigate CVE-2026-55793

Immediate Actions Required

Upgrade Craft CMS to version 5.9.23 or later on all environments hosting the control panel
Review existing entry titles across all Structure sections and sanitize any titles containing HTML or script content
Rotate admin session tokens and API keys if drag operations were performed on entries authored by untrusted users since the vulnerable range was deployed

Patch Information

Craft CMS resolved the issue in version 5.9.23. The fix, tracked in GHSA-xrqc-p465-2xvg, replaces unsafe string concatenation with jQuery's attribute-object constructor, which properly escapes attribute values. Administrators should apply the update via composer update craftcms/cms and run php craft up to finalize the deployment.

Workarounds

Restrict the Author role to trusted users only and require additional review before granting saveEntries on shared Structure sections
Avoid drag-to-reorder operations in structure table view until the patch is applied, using the entry edit screen to change parents instead
Deploy a strict Content Security Policy that disallows inline event handlers on the /admin path to reduce the impact of stored payloads

bash

# Upgrade Craft CMS to the patched release
composer require craftcms/cms:^5.9.23 --update-with-dependencies
php craft up
php craft clear-caches/all