CVE-2023-33196
Craft CMS stored XSS in review volume
Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Craft CMS stored XSS in review volume
Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.
- Record
CVE-2023-33196- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-80
- Updated
- 2026-11-02
EUVDEUVD-2023-1526
Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.
- Record
EUVD-2023-1526- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cjmm-x9x9-m2w5
Craft CMS stored XSS in review volume
Summary
XSS can be triggered by review volumes
PoC
1. Access setting tab
2. Create new assets
3. In assets name inject payload: "<script>alert(1337)</script>
4. Click Utilities tab
5. Choose all volumes, or volume trigger xss
6. Click Update asset indexes.
7. Wait to assets update success.
8. Progress complete.
9. Click on review button will trigger XSS
Root cause
Function: index.php?p=admin/actions/asset-indexes/process-indexing-session&v=1680710595770 After loading completed, progess will load: "skippedEntries" and "missingEntries" These parameters is not yet filtered, I just tried "skippedEntries" but I think it will be work with "missingEntries"
My reponse:
{ "session": { "id": 10, "indexedVolumes": { "6": ""<script>alert(1337)</script>" }, "totalEntries": 2235, "processedEntries": 2235, "cacheRemoteImages": true, "listEmptyFolders": false, "isCli": false, "actionRequired": true, "dateCreated": "Apr 5, 2023, 9:03:16 AM", "skippedEntries": [ ""<script>alert(1337)</script>/assetpreviews/Image.php", ""<script>alert(1337)</script>/assetpreviews/Pdf.php" ], "missingEntries": { "folders": [], "files": [] }, "processIfRootEmpty": false }, "skipDialog": false }
Resolved in https://github.com/craftcms/cms/commit/053d7119697e480ff81c5723bb9a33eaa49e0fc7
- Record
GHSA-cjmm-x9x9-m2w5- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-79, CWE-80
- Updated
- 2026-11-02
NVD
Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.
- Record
CVE-2023-33196- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-80, CWE-79
- Updated
- 2026-11-02
OSV
Craft CMS stored XSS in review volume
Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.
- Record
CVE-2023-33196- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-80
- Updated
- 2026-11-02
OSVGHSA-cjmm-x9x9-m2w5
Craft CMS stored XSS in review volume
Summary
XSS can be triggered by review volumes
PoC
1. Access setting tab
2. Create new assets
3. In assets name inject payload: "<script>alert(1337)</script>
4. Click Utilities tab
5. Choose all volumes, or volume trigger xss
6. Click Update asset indexes.
7. Wait to assets update success.
8. Progress complete.
9. Click on review button will trigger XSS
Root cause
Function: index.php?p=admin/actions/asset-indexes/process-indexing-session&v=1680710595770 After loading completed, progess will load: "skippedEntries" and "missingEntries" These parameters is not yet filtered, I just tried "skippedEntries" but I think it will be work with "missingEntries"
My reponse:
{ "session": { "id": 10, "indexedVolumes": { "6": ""<script>alert(1337)</script>" }, "totalEntries": 2235, "processedEntries": 2235, "cacheRemoteImages": true, "listEmptyFolders": false, "isCli": false, "actionRequired": true, "dateCreated": "Apr 5, 2023, 9:03:16 AM", "skippedEntries": [ ""<script>alert(1337)</script>/assetpreviews/Image.php", ""<script>alert(1337)</script>/assetpreviews/Pdf.php" ], "missingEntries": { "folders": [], "files": [] }, "processIfRootEmpty": false }, "skipDialog": false }
Resolved in https://github.com/craftcms/cms/commit/053d7119697e480ff81c5723bb9a33eaa49e0fc7
- Record
GHSA-cjmm-x9x9-m2w5- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-79, CWE-80
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
craftcms/cmsPackagist |
4.0.0-RC1 to 4.4.6 | 4.4.7 |
craftcms/cmsPackagist |
4.0.0-RC1 up to 4.4.7, plus listed versions 4.0.04.0.0-RC24.0.0-RC34.0.0.14.0.1 Show 45 moreShow less4.0.24.0.34.0.44.0.54.0.5.14.0.5.24.0.64.1.04.1.0.14.1.0.24.1.14.1.24.1.34.1.44.1.4.14.2.04.2.0.14.2.0.24.2.14.2.1.14.2.24.2.34.2.44.2.54.2.5.14.2.5.24.2.64.2.74.2.84.3.04.3.14.3.104.3.114.3.24.3.2.14.3.34.3.44.3.54.3.64.3.6.14.3.74.3.7.14.3.84.3.8.14.3.8.2 |
4.4.7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-33196 is a medium vulnerability (CVSS 5.5) in Craftcms Cms, published May 26, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.65%, the 51st percentile. Fixed in craftcms/cms 4.4.7.
References
github.com/craftcms/cms/security/advisories/GHSA-cjmm-x9x9-m2w5
nvd.nist.gov/vuln/detail/CVE-2023-33196
Left out here: 16 versions. The JSON record has them.