Executive Summary

[{'type': 'paragraph', 'content': 'CVE-2026-27126 is a stored Cross-Site Scripting (XSS) vulnerability in the Craft CMS platform, specifically in the editableTable.twig component when using the "html" column type in table fields.'}, {'type': 'paragraph', 'content': 'The vulnerability occurs because the application fails to properly sanitize input in this context, allowing an attacker to inject arbitrary JavaScript code.'}, {'type': 'paragraph', 'content': 'This malicious code executes when another user views a page containing the affected table field.'}, {'type': 'paragraph', 'content': "Exploitation requires the attacker to have an administrator account and the allowAdminChanges setting enabled in production, which is against Craft's security recommendations."}, {'type': 'paragraph', 'content': 'The "html" column type is not normally available via the UI but can be exploited by intercepting and modifying the save field request to change a column type to "html".'}] [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker with administrator access to inject and execute arbitrary JavaScript code within the CMS.

When other users view pages containing the malicious table field, the injected script runs in their browsers, potentially leading to session hijacking, data theft, or other malicious actions.

Because exploitation requires administrator privileges and a specific configuration (allowAdminChanges enabled in production), the risk is somewhat limited but still significant if those conditions are met.

The vulnerability can compromise the integrity and security of the CMS environment and its users.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by checking if your Craft CMS installation uses affected versions (4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22) and if the editableTable.twig component contains table fields with the "html" column type.'}, {'type': 'paragraph', 'content': 'Since the "html" column type is not available via the UI dropdown, detection involves intercepting and inspecting save field requests to see if the parameter `types[craft-fields-Table][columns][col3][type]` or similar is set to "html".'}, {'type': 'paragraph', 'content': 'You can use proxy tools like Burp Suite or command-line tools like cURL to capture and analyze these requests.'}, {'type': 'list_item', 'content': 'Use Burp Suite or a similar proxy to intercept HTTP requests when saving table fields in Craft CMS and check for the presence of the "html" column type in the request payload.'}, {'type': 'list_item', 'content': 'Run a command like the following to fetch the field configuration and search for the "html" column type (replace URL and authentication as needed):'}, {'type': 'list_item', 'content': 'curl -X GET "https://your-craftcms-site/api/fields" -H "Authorization: Bearer <token>" | grep \'"type":"html"\''}, {'type': 'paragraph', 'content': 'Note that detection requires access to administrative API endpoints or the ability to intercept admin requests, as exploitation requires an administrator account.'}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

[{'type': 'paragraph', 'content': 'The immediate mitigation steps are to upgrade Craft CMS to a patched version where this vulnerability is fixed.'}, {'type': 'list_item', 'content': 'Upgrade to Craft CMS version 4.16.19 or later if you are on the 4.x branch.'}, {'type': 'list_item', 'content': 'Upgrade to Craft CMS version 5.8.23 or later if you are on the 5.x branch.'}, {'type': 'paragraph', 'content': "Additionally, ensure that the `allowAdminChanges` setting is disabled in production environments, as enabling it is against Craft's security recommendations and is required for exploitation."}, {'type': 'paragraph', 'content': 'The patch removes support for the unsafe "html" column type and enforces strict validation of allowed column types, preventing this attack vector.'}] [1, 2]

Useful 0 Not Useful 0