CVE-2026-109307
Received Received - Intake

DOM-based XSS in Craft CMS Control Panel

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
Craft CMS 5.0.0 before 5.10.14 contains a DOM-based cross-site scripting vulnerability in the control panel login and 2FA verification flow, where a user-controlled returnUrl accepting javascript: URLs is used in client-side navigation. Attackers can lure a 2FA-enabled victim into opening a crafted /admin/login?verify=1 URL between password submission and TOTP verification, executing JavaScript in the authenticated control panel with the victim's permissions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109307
EUVD
EUVD-2026-97609

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
craftcms cms 5.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-109307 is a DOM-based cross-site scripting (XSS) vulnerability in Craft CMS versions 5.0.0 through 5.10.13. It occurs during the control panel login and two-factor authentication (2FA) verification flow. The issue involves a user-controlled returnUrl parameter that improperly handles javascript: URLs during client-side navigation. Attackers can exploit this by tricking a 2FA-enabled victim into visiting a crafted URL like /admin/login?verify=1 between password submission and TOTP verification. This allows arbitrary JavaScript execution within the authenticated control panel.

Detection Guidance

To detect this vulnerability, inspect Craft CMS versions 5.0.0 through 5.10.13 for the presence of the DOM-based XSS flaw in the control panel login and 2FA verification flow. Check for improper handling of javascript: URLs in the returnUrl parameter during client-side navigation. Verify if the system is patched to version 5.10.14 or later.

Impact Analysis

If you are a Craft CMS user with 2FA enabled, an attacker could exploit this vulnerability to execute malicious JavaScript in your authenticated control panel session. This could allow the attacker to perform actions on your behalf, such as modifying entries, disabling content, or accessing sensitive data, depending on your permissions. The attack requires tricking you into clicking a specially crafted link during the login process.

Mitigation Strategies

Immediately update Craft CMS to version 5.10.14 or later to patch the vulnerability. If updating is not immediately possible, disable 2FA verification flow temporarily or restrict access to the control panel login page until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109307. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart