CVE-2026-56383: Craft CMS Stored XSS Vulnerability

CVE-2026-56383 Overview

Craft CMS contains a stored cross-site scripting (XSS) vulnerability in the editableTable.twig component when the Row Heading column type is used. The application fails to sanitize input within row heading default values. An attacker holding an administrator account with allowAdminChanges enabled can inject arbitrary JavaScript that executes when another user views a page containing the affected table field. The flaw is tracked as [CWE-79] and affects Craft CMS versions >= 4.5.0-beta.1 through 4.16.18 and >= 5.0.0-RC1 through 5.8.22. Fixed releases are 4.16.19 and 5.8.23.

Critical Impact
Authenticated administrators can store JavaScript payloads that execute in the browser sessions of other CMS users, enabling session theft, account takeover, and unauthorized actions within the Craft CMS control panel.

Affected Products

Craft CMS versions >= 4.5.0-beta.1 through 4.16.18
Craft CMS versions >= 5.0.0-RC1 through 5.8.22
Deployments with allowAdminChanges enabled

Discovery Timeline

2026-06-21 - CVE-2026-56383 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-56383

Vulnerability Analysis

The vulnerability resides in Craft CMS's Table field type, specifically the editableTable.twig template responsible for rendering editable table columns in the control panel. When a column is configured with the Row Heading type, the default value supplied by an administrator is written into the rendered output without HTML encoding. The _getInputHtml() method in src/fields/Table.php returned the raw heading value rather than passing it through Html::encode(). As a result, JavaScript payloads stored in the row heading default persist in the database and execute whenever another authenticated user opens an entry containing that table field.

Root Cause

The root cause is missing output encoding for the heading case branch in the field's value normalization logic. The patched code removes the unsafe pass-through and ensures heading values are HTML-encoded before being injected into the editable table template. Because the injection point sits inside the control panel, payloads execute within the privileged session context of CMS editors and administrators.

Attack Vector

Exploitation requires an authenticated administrator account with allowAdminChanges enabled. The attacker creates or edits a Table field, configures a column with the Row Heading type, and sets a default value containing a JavaScript payload such as a script tag or event handler. When another user navigates to an entry that uses the field, the stored payload renders in the control panel and executes in that user's browser. User interaction is required to view the affected page.

php

// Security patch in src/fields/Table.php - removes unsafe heading branch
// from _getInputHtml() value normalization
            case 'date':
            case 'time':
                return DateTimeHelper::toDateTime($value) ?: null;
-                
-            case 'heading':
-                return Html::encode($value);
        }

        return $value;
// Source: https://github.com/craftcms/cms/commit/7b372de262b8d9d2ce859f32780c3715719b6f5a

Detection Methods for CVE-2026-56383

Indicators of Compromise

Table field configurations containing Row Heading columns whose default values include <script>, onerror=, onload=, or javascript: strings.
Unexpected outbound requests from control panel sessions to attacker-controlled domains immediately after viewing entries with Table fields.
Audit log entries showing administrator-level modifications to Table field settings followed by anomalous session activity from non-admin users.

Detection Strategies

Query the Craft CMS database for fields and field_layouts records of type craft\fields\Table and inspect column definitions for HTML or JavaScript syntax in heading defaults.
Enable Content Security Policy (CSP) reporting on the control panel domain and review reports for inline script violations originating from editableTable.twig rendering.
Review web server access logs for control panel requests followed by anomalous JSON or form submissions that indicate scripted actions taken on behalf of victim sessions.

Monitoring Recommendations

Alert on changes to Craft CMS Table field configurations, particularly the creation or modification of columns with the heading type.
Monitor administrator account activity for unexpected logins, IP changes, or use of the allowAdminChanges configuration flag in production.
Track CMS user sessions for token reuse from new IP addresses, which can indicate session theft following XSS execution.

How to Mitigate CVE-2026-56383

Immediate Actions Required

Upgrade Craft CMS to version 4.16.19 (for 4.x branches) or 5.8.23 (for 5.x branches) without delay.
Disable allowAdminChanges in production environments so administrators cannot modify field definitions through the control panel.
Audit existing Table fields for Row Heading columns containing suspicious default values and remove or sanitize them.

Patch Information

The fix is delivered in Craft CMS 4.16.19 and 5.8.23. The upstream commit 7b372de262b8d9d2ce859f32780c3715719b6f5a restructures the heading value handling in src/fields/Table.php and ensures heading values are properly encoded when rendered. Additional context is available in the GitHub Security Advisory GHSA-6j87-m5qx-9fqp and the VulnCheck advisory.

Workarounds

Set allowAdminChanges to false in config/general.php for production environments to block administrators from creating or modifying Table fields that could carry payloads.
Restrict administrator account assignment to a minimal set of trusted users and enforce multi-factor authentication on those accounts.
Apply a strict Content Security Policy that disallows inline scripts in the Craft control panel until the upgrade is completed.

bash

# Upgrade Craft CMS via Composer to a patched release
composer require craftcms/cms:^5.8.23 --update-with-dependencies
# or for the 4.x branch
composer require craftcms/cms:^4.16.19 --update-with-dependencies

# Disable admin changes in production (config/general.php)
# 'allowAdminChanges' => false,

php craft up