CVE-2026-27126 PUBLISHED

Craft CMS has Stored XSS in Table Field via "HTML" Column Type

Assigner: GitHub_M
Reserved: 17.02.2026 Published: 24.02.2026 Updated: 24.02.2026

Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, a stored Cross-site Scripting (XSS) vulnerability exists in the editableTable.twig component when using the html column type. The application fails to sanitize the input, allowing an attacker to execute arbitrary JavaScript when another user views a page with the malicious table field. In order to exploit the vulnerability, an attacker must have an administrator account, and allowAdminChanges must be enabled in production, which is against Craft's security recommendations. Versions 4.16.19 and 5.8.23 patch the issue.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS Score: 5.9

Product Status

Vendor craftcms
Product cms
Versions
  • Version >= 4.5.0-RC1, < 4.16.19 is affected
  • Version >= 5.0.0-RC1, < 5.8.23 is affected

References

Problem Types

  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE