CVE-2026-92590: Craft CMS Stored XSS Vulnerability

CVE-2026-92590 Overview

CVE-2026-92590 is a stored cross-site scripting [CWE-79] vulnerability in Craft CMS. Affected versions run from 5.7.0 up to but not including 5.10.13. The flaw resides in the Generated Fields feature, which disables Twig autoescaping and fails to encode cached values before rendering them in the Control Panel.

Content editors with permission to edit fields can inject JavaScript payloads that persist in cached output. When higher-privileged users view element indexes, the payload executes in their authenticated Control Panel session, enabling actions in the victim's security context.

Critical Impact
Authenticated low-privilege editors can escalate influence by executing arbitrary JavaScript in administrator Control Panel sessions, enabling session-scoped actions against Craft CMS installations.

Affected Products

Craft CMS 5.7.0 through 5.10.12
Craft CMS installations using the Generated Fields feature
Control Panel element indexes rendering cached generated field values

Discovery Timeline

2026-09-16 - CVE-2026-92590 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92590

Vulnerability Analysis

Craft CMS Generated Fields compute values from Twig templates and cache the results for display in element indexes. The rendering path for these cached values disables Twig's default autoescaping. It also skips output encoding when writing the cached string into HTML.

When a content editor authors a Generated Field expression that produces HTML or JavaScript content, that raw markup is stored and later injected verbatim into Control Panel pages. Any user with permission to view the element index triggers execution of the injected script under their session.

The vulnerability requires authenticated access with editor-level privileges and passive user interaction from a higher-privileged victim. Attack surface is limited to the Control Panel, but the impact crosses a privilege boundary from editor to administrator.

Root Cause

The root cause is a combination of two unsafe defaults in the Generated Fields rendering pipeline. First, Twig autoescaping is explicitly disabled for generated field output. Second, cached values are written to the DOM without applying HTML entity encoding as a compensating control.

This violates the defense-in-depth principle for template rendering. Either autoescaping or explicit output encoding would neutralize the payload, but neither is applied.

Attack Vector

An authenticated attacker with content editor privileges configures a Generated Field with a Twig expression containing a JavaScript payload such as an inline <script> block or an event handler on an HTML element. The rendered value is cached during element save.

When an administrator or other higher-privileged user navigates to an element index that displays the field, the browser parses the cached HTML and executes the attacker's script within the Control Panel origin. The script can invoke Control Panel APIs, exfiltrate CSRF tokens, or perform actions on behalf of the victim.

No verified proof-of-concept code is published. See the GitHub Security Advisory and VulnCheck XSS Advisory for vendor technical details.

Detection Methods for CVE-2026-92590

Indicators of Compromise

Generated Field definitions containing <script> tags, on* event handler attributes, or javascript: URI schemes
Unexpected outbound requests originating from Control Panel browser sessions to attacker-controlled domains
Control Panel audit log entries showing administrative actions initiated shortly after an editor viewed or saved an element
Cached generated field values in the database containing raw HTML markup rather than plain text

Detection Strategies

Query the Craft CMS field configuration tables for Generated Field templates and inspect them for HTML or JavaScript syntax
Enable Content Security Policy reporting in the Control Panel to surface inline script execution attempts
Review web server access logs for Control Panel requests immediately followed by anomalous administrative API calls from the same session

Monitoring Recommendations

Alert on new or modified Generated Field definitions authored by non-administrator accounts
Monitor Control Panel sessions for JavaScript-driven privilege changes such as user role modifications or API token generation
Log and review element index page renders that follow recent Generated Field edits by lower-privileged users

How to Mitigate CVE-2026-92590

Immediate Actions Required

Upgrade Craft CMS to version 5.10.13 or later on all environments running versions in the 5.7.0 to 5.10.12 range
Audit existing Generated Field definitions for embedded HTML or JavaScript and remove untrusted content before upgrade
Restrict permission to create or edit Generated Fields to trusted administrator accounts until patching is complete

Patch Information

Craft CMS 5.10.13 addresses the vulnerability by restoring safe output handling for Generated Field values. Refer to the GitHub Security Advisory GHSA-h9jh-v8vc-m5rp for the vendor release notes and upgrade instructions.

Workarounds

Temporarily disable the Generated Fields feature or remove affected field configurations from element indexes
Apply a strict Content Security Policy to the Control Panel that blocks inline scripts and unauthorized script sources
Reduce the number of accounts with field-editing permissions to limit the pool of potential attackers

bash

# Verify installed Craft CMS version and upgrade via Composer
php craft --version
composer require craftcms/cms:^5.10.13 --update-with-dependencies
php craft up