CVE-2026-56393

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-56393", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-06-21T12:37:58.434Z", "datePublished": "2026-06-21T13:27:01.755Z", "dateUpdated": "2026-11-08T14:06:11.266Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-08T14:06:11.266Z"}, "datePublic": "2026-03-02T00:00:00.000Z", "title": "Craft CMS - Multiple Stored Cross-Site Scripting in Settings Names and Field Options", "descriptions": [{"lang": "en", "value": "Craft CMS 4.x (>= 4.0.0-RC1, < 4.17.0-beta.1) and 5.x (>= 5.0.0-RC1, < 5.9.0-beta.1) contain multiple stored cross-site scripting vulnerabilities where settings names and field option labels are rendered without sanitization (e.g., via the checkbox.twig template, which used {{ label|raw }}). An authenticated administrator (with allowAdminChanges enabled) can inject malicious payloads into section names, volume names, user group names, global set names, generated field names, checkbox/radio option labels, and custom source labels, causing arbitrary JavaScript to execute in other users' control-panel sessions. Fixed in 4.17.0-beta.1 and 5.9.0-beta.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "affected": [{"vendor": "craftcms", "product": "cms", "defaultStatus": "unaffected", "versions": [{"version": "5.0.0-RC1", "status": "affected", "versionType": "semver", "lessThan": "5.9.0-beta.1"}, {"version": "5.9.0-beta.1", "status": "unaffected", "versionType": "semver"}, {"version": "4.0.0-RC1", "status": "affected", "versionType": "semver", "lessThan": "4.17.0-beta.1"}, {"version": "4.17.0-beta.1", "status": "unaffected", "versionType": "semver"}], "packageURL": "pkg:composer/craftcms/cms"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:juzaweb:cms:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0.0-RC1", "versionEndExcluding": "5.9.0-beta.1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:juzaweb:cms:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0.0-RC1", "versionEndExcluding": "4.17.0-beta.1"}]}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 4.6, "baseSeverity": "MEDIUM", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS"}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS"}], "references": [{"url": "https://github.com/craftcms/cms/security/advisories/GHSA-4mgv-366x-qxvx", "name": "GitHub Security Advisory (GHSA-4mgv-366x-qxvx)", "tags": ["vendor-advisory"]}, {"url": "https://github.com/craftcms/cms/commit/943152d2246b36f12adf161a03b8695b773d9276", "name": "https://github.com/craftcms/cms/commit/943152d2246b36f12adf161a03b8695b773d9276", "tags": ["patch"]}, {"url": "https://github.com/craftcms/cms/commit/67780a778c6ec04e68e64a0b1177c168306144a2", "name": "https://github.com/craftcms/cms/commit/67780a778c6ec04e68e64a0b1177c168306144a2", "tags": ["patch"]}, {"name": "VulnCheck Advisory: Craft CMS - Multiple Stored Cross-Site Scripting in Settings Names and Field Options", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/craft-cms-multiple-stored-cross-site-scripting-in-settings-names-and-field-options"}], "credits": [{"lang": "en", "value": "mHe4am", "type": "reporter"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"references": [{"url": "https://github.com/craftcms/cms/security/advisories/GHSA-4mgv-366x-qxvx", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-22T13:21:37.669665Z", "id": "CVE-2026-56393", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-22T13:22:05.584Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-56393", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-22T13:21:37.669665Z"}}}], "references": [{"url": "https://github.com/craftcms/cms/security/advisories/GHSA-4mgv-366x-qxvx", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-22T13:22:00.581Z"}}], "cna": {"title": "Craft CMS - Multiple Stored Cross-Site Scripting in Settings Names and Field Options", "credits": [{"lang": "en", "type": "reporter", "value": "mHe4am"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "craftcms", "product": "cms", "versions": [{"status": "affected", "version": "5.0.0-RC1", "lessThan": "5.9.0-beta.1", "versionType": "semver"}, {"status": "unaffected", "version": "5.9.0-beta.1", "versionType": "semver"}, {"status": "affected", "version": "4.0.0-RC1", "lessThan": "4.17.0-beta.1", "versionType": "semver"}, {"status": "unaffected", "version": "4.17.0-beta.1", "versionType": "semver"}], "packageURL": "pkg:composer/craftcms/cms", "defaultStatus": "unaffected"}], "datePublic": "2026-03-02T00:00:00.000Z", "references": [{"url": "https://github.com/craftcms/cms/security/advisories/GHSA-4mgv-366x-qxvx", "name": "GitHub Security Advisory (GHSA-4mgv-366x-qxvx)", "tags": ["vendor-advisory"]}, {"url": "https://github.com/craftcms/cms/commit/943152d2246b36f12adf161a03b8695b773d9276", "name": "https://github.com/craftcms/cms/commit/943152d2246b36f12adf161a03b8695b773d9276", "tags": ["patch"]}, {"url": "https://github.com/craftcms/cms/commit/67780a778c6ec04e68e64a0b1177c168306144a2", "name": "https://github.com/craftcms/cms/commit/67780a778c6ec04e68e64a0b1177c168306144a2", "tags": ["patch"]}, {"url": "https://www.vulncheck.com/advisories/craft-cms-multiple-stored-cross-site-scripting-in-settings-names-and-field-options", "name": "VulnCheck Advisory: Craft CMS - Multiple Stored Cross-Site Scripting in Settings Names and Field Options", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Craft CMS 4.x (>= 4.0.0-RC1, < 4.17.0-beta.1) and 5.x (>= 5.0.0-RC1, < 5.9.0-beta.1) contain multiple stored cross-site scripting vulnerabilities where settings names and field option labels are rendered without sanitization (e.g., via the checkbox.twig template, which used {{ label|raw }}). An authenticated administrator (with allowAdminChanges enabled) can inject malicious payloads into section names, volume names, user group names, global set names, generated field names, checkbox/radio option labels, and custom source labels, causing arbitrary JavaScript to execute in other users' control-panel sessions. Fixed in 4.17.0-beta.1 and 5.9.0-beta.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:juzaweb:cms:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.9.0-beta.1", "versionStartIncluding": "5.0.0-RC1"}, {"criteria": "cpe:2.3:a:juzaweb:cms:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.17.0-beta.1", "versionStartIncluding": "4.0.0-RC1"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-08T14:06:11.266Z"}}}, "cveMetadata": {"cveId": "CVE-2026-56393", "state": "PUBLISHED", "dateUpdated": "2026-11-08T14:06:11.266Z", "dateReserved": "2026-06-21T12:37:58.434Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-06-21T13:27:01.755Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:composer/craftcms/cms", "product": "cms", "vendor": "craftcms", "versions": [{"lessThan": "5.9.0-beta.1", "status": "affected", "version": "5.0.0-RC1", "versionType": "semver"}, {"status": "unaffected", "version": "5.9.0-beta.1", "versionType": "semver"}, {"lessThan": "4.17.0-beta.1", "status": "affected", "version": "4.0.0-RC1", "versionType": "semver"}, {"status": "unaffected", "version": "4.17.0-beta.1", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Craft CMS 4.x (>= 4.0.0-RC1, < 4.17.0-beta.1) and 5.x (>= 5.0.0-RC1, < 5.9.0-beta.1) contain multiple stored cross-site scripting vulnerabilities where settings names and field option labels are rendered without sanitization (e.g., via the checkbox.twig template, which used {{ label|raw }}). An authenticated administrator (with allowAdminChanges enabled) can inject malicious payloads into section names, volume names, user group names, global set names, generated field names, checkbox/radio option labels, and custom source labels, causing arbitrary JavaScript to execute in other users' control-panel sessions. Fixed in 4.17.0-beta.1 and 5.9.0-beta.1."}, {"lang": "es", "value": "Craft CMS 4.x (>= 4.0.0-RC1, anterior a 4.17.0-beta.1) y 5.x (>= 5.0.0-RC1, anterior a 5.9.0-beta.1) contienen m\u00faltiples vulnerabilidades de cross-site scripting almacenado donde los nombres de las configuraciones y las etiquetas de las opciones de campo se renderizan sin sanitizaci\u00f3n (por ejemplo, a trav\u00e9s de la plantilla checkbox.twig, que utilizaba {{ label|raw }}). Un administrador autenticado (con allowAdminChanges habilitado) puede inyectar cargas \u00fatiles maliciosas en nombres de secciones, nombres de vol\u00famenes, nombres de grupos de usuarios, nombres de conjuntos globales, nombres de campos generados, etiquetas de opciones de casilla de verificaci\u00f3n/radio y etiquetas de fuentes personalizadas, causando que JavaScript arbitrario se ejecute en las sesiones del panel de control de otros usuarios. Corregido en 4.17.0-beta.1 y 5.9.0-beta.1."}], "id": "CVE-2026-56393", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 2.7, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-56393", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-22T13:21:37.669665Z", "version": "2.0.3"}}]}, "published": "2026-06-21T14:16:26.277", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/craftcms/cms/commit/67780a778c6ec04e68e64a0b1177c168306144a2"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/craftcms/cms/commit/943152d2246b36f12adf161a03b8695b773d9276"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/craftcms/cms/security/advisories/GHSA-4mgv-366x-qxvx"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/craft-cms-multiple-stored-cross-site-scripting-in-settings-names-and-field-options"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/craftcms/cms/security/advisories/GHSA-4mgv-366x-qxvx"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0-RC1,5.9.0-beta.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "5.9.0-beta.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0-RC1,4.17.0-beta.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "4.17.0-beta.1"}}], "enrichment": {"confidence": 83.0, "confidence_source": "matching", "scores": [{"score": 83.0, "source": "matching"}]}, "original": {"product": "cms", "source": "cna", "vendor": "craftcms"}, "product": "craftcms", "vendor": "craftcms"}], "created": "2026-06-21T16:45:03.967751+00:00", "updated": "2026-06-24T16:08:14.902576+00:00", "vendors": ["craftcms", "craftcms$PRODUCT$craftcms"]}