Executive Summary

CVE-2026-56393 is a stored cross-site scripting (XSS) vulnerability in Craft CMS versions 4.x and 5.x before certain beta releases. It occurs because settings names and field option labels are rendered without proper sanitization, for example using the unsafe {{ label|raw }} filter in templates like checkbox.twig.

An authenticated administrator with the allowAdminChanges permission can inject malicious JavaScript payloads into various settings such as section names, volume names, user group names, global set names, generated field names, checkbox/radio option labels, and custom source labels.

These injected scripts then execute in the control-panel sessions of other users, potentially compromising their accounts or data.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an authenticated administrator with the appropriate permissions to inject malicious JavaScript into various settings and field options within Craft CMS.

As a result, arbitrary JavaScript can execute in the control-panel sessions of other users, potentially leading to session hijacking, unauthorized actions, or data exposure within the CMS backend.

The impact is limited to users who access the control panel and can be exploited only if the allowAdminChanges setting is enabled.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves stored cross-site scripting (XSS) in Craft CMS settings and field option labels that are rendered without sanitization. Detection typically requires inspecting the content of settings names, field option labels, and other affected fields for injected malicious JavaScript payloads.

Since the vulnerability is exploited by an authenticated administrator with allowAdminChanges enabled, detection involves reviewing administrative inputs and rendered templates for unsafe usage of raw HTML output filters such as {{ label|raw }}.

There are no specific network commands or automated detection commands provided in the available resources. However, manual inspection or automated scanning of the CMS database entries for suspicious script tags or JavaScript payloads in section names, volume names, user group names, global set names, generated field names, checkbox/radio option labels, and custom source labels can help identify exploitation.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade Craft CMS to a fixed version where the vulnerability is addressed. Specifically, update to version 4.17.0-beta.1 or later for the 4.x series, or 5.9.0-beta.1 or later for the 5.x series.

Additionally, it is recommended to disable the allowAdminChanges setting in production environments to prevent authenticated administrators from injecting malicious payloads.

The patches remove unsafe raw HTML output in templates and enforce stricter input validation and sanitization, so applying these updates will prevent exploitation.

Useful 0 Not Useful 0