CVE-2026-84793 Overview
CVE-2026-84793 is a stored cross-site scripting (XSS) vulnerability in Craft CMS affecting versions from 5.0.0-RC1 before 5.10.11. The site name field does not sanitize user input, allowing administrators to inject arbitrary JavaScript. The injected payload executes in the browser of any user who views the affected control panel settings pages. The flaw is classified under CWE-79, improper neutralization of input during web page generation. Exploitation requires high privileges and user interaction, which limits real-world impact but still enables session-level attacks against control panel users.
Critical Impact
An authenticated administrator can persistently inject JavaScript through the Craft CMS site name field, executing arbitrary script in the browsers of other control panel users.
Affected Products
- Craft CMS versions 5.0.0-RC1 through 5.10.10
- Craft CMS control panel settings pages that render the site name
- Fixed in Craft CMS 5.10.11
Discovery Timeline
- 2026-09-02 - CVE-2026-84793 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-84793
Vulnerability Analysis
The vulnerability resides in Craft CMS site configuration handling. The application accepts the site name value from an authenticated administrator without properly encoding or sanitizing HTML metacharacters. When the control panel later renders the site name in settings pages, the stored payload is emitted into the response as executable markup. Any authenticated user with access to those settings pages triggers the payload in their browser session.
Because the payload is stored server-side, exploitation persists across sessions until an administrator overwrites the value. The vulnerability enables session token theft, control panel action forgery, and further pivoting within the CMS in the context of the viewing user.
Root Cause
The root cause is missing output encoding of the site name field on control panel settings templates. Craft CMS treats the value as trusted configuration data rather than untrusted input requiring contextual escaping. This is a classic CWE-79 stored XSS pattern where privileged-input fields bypass the sanitization applied to end-user content.
Attack Vector
An attacker must first obtain administrator credentials or compromise an existing administrator account. The attacker then edits the site name in Craft CMS configuration and stores a JavaScript payload such as an <img> tag with an onerror handler or an inline <script> block. When another control panel user, including higher-privileged accounts, loads settings pages that render the site name, the payload executes. This creates a lateral movement path between administrator accounts and any user visiting the affected views.
Refer to the GitHub Security Advisory GHSA-5fjj-496j-2qqf and the VulnCheck Advisory on Craft CMS for additional technical context.
Detection Methods for CVE-2026-84793
Indicators of Compromise
- Site name values in Craft CMS configuration containing HTML tags, <script> blocks, or event handlers such as onerror, onload, or onmouseover.
- Unexpected outbound requests from control panel user browsers to attacker-controlled domains shortly after loading settings pages.
- Audit log entries showing site name modifications by administrator accounts outside normal change windows.
Detection Strategies
- Review the Craft CMS sites configuration and database records for site name values containing angle brackets or JavaScript syntax.
- Inspect web server access logs for POST requests to Craft CMS site settings endpoints correlated with administrator sessions.
- Deploy a Content Security Policy (CSP) with reporting enabled to identify inline script execution in the control panel.
Monitoring Recommendations
- Alert on modifications to the site name field and require review of any value containing HTML metacharacters.
- Monitor administrator authentication events and correlate them with configuration changes in Craft CMS.
- Track anomalous control panel sessions that generate unexpected DOM-level network activity.
How to Mitigate CVE-2026-84793
Immediate Actions Required
- Upgrade Craft CMS to version 5.10.11 or later across all environments.
- Audit the current site name value in each Craft CMS installation and remove any HTML or script content.
- Rotate administrator session tokens and credentials if any suspicious site name modifications are found.
- Restrict administrator role assignment to the minimum necessary set of accounts.
Patch Information
Craft CMS 5.10.11 remediates CVE-2026-84793 by sanitizing input to the site name field and applying contextual output encoding on control panel settings pages. See the GitHub Security Advisory GHSA-5fjj-496j-2qqf for release details and the VulnCheck Advisory on Craft CMS for scope information.
Workarounds
- Manually inspect and clean the site name field to ensure it contains only plain text until patching is complete.
- Enforce a strict Content Security Policy on the Craft CMS control panel to block inline scripts.
- Limit administrator access to trusted personnel and enforce multi-factor authentication on all privileged accounts.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
