{"id":"CVE-2024-45406","aliases":["EUVD-2024-2692","GHSA-28h4-788g-rh42"],"status":"published","title":"Craft CMS stored XSS in breadcrumb list and title fields","description":"Craft is a content management system (CMS). Craft CMS 5 stored XSS can be triggered by the breadcrumb list and title fields with user input.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00354,"percentile":0.29561,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79","CWE-80"],"published":"2024-09-09T16:46:26Z","modified":"2026-10-28T02:30:29Z","fixes":[{"ecosystem":"Packagist","package":"craftcms/cms","fixed_in":["5.1.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"craftcms/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.1.2"}]}]},{"source":"osv","ecosystem":"Packagist","package":"craftcms/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.1.2"}]}],"versions":["5.0.0","5.0.1","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.1.0","5.1.1"]}],"products":[{"vendor":"craftcms","product":"cms"},{"vendor":"craftcms","product":"craft_cms"},{"vendor":"statamic","product":"cms"}],"references":[{"url":"https://github.com/craftcms/cms/security/advisories/GHSA-28h4-788g-rh42","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/craftcms/cms/commit/b7348942f8131b3868ec6f46d615baae50151bb8","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45406","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-28h4-788g-rh42"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45406.json","tags":["advisory"]},{"url":"https://github.com/craftcms/cms","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-45406","title":"Craft CMS stored XSS in breadcrumb list and title fields","description":"Craft is a content management system (CMS). Craft CMS 5 stored XSS can be triggered by the breadcrumb list and title fields with user input.","status":"published","published":"2024-09-09T16:46:26.948Z","modified":"2024-09-09T19:59:08.697Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-80","CWE-79"],"updated_at":"2026-11-02T14:34:07.831255Z"}],"euvd":[{"id":"EUVD-2024-2692","description":"Craft is a content management system (CMS). Craft CMS 5 stored XSS can be triggered by the breadcrumb list and title fields with user input.","status":"published","published":"2024-09-09T16:46:26Z","modified":"2024-09-09T19:59:08Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T00:56:00.258951Z"}],"ghsa":[{"id":"GHSA-28h4-788g-rh42","title":"Craft CMS vulnerable to stored XSS in breadcrumb list and title fields","description":"### Summary\nMultiple Stored XSS can be triggered by the breadcrumb list and title fields with user input.\n\n### Details\n1. In the **/admin/categories** page, category title isn't sanitized and triggered xss.\n2. In the category edit page under the **/admin/categories/**, category title in breadcrumb list isn't sanitized and triggered xss.\n3. In the **/admin/entries** page, entry title isn't sanitized and triggered xss.\n4. In the entry edit page under the **/admin/entries/**, entry title in breadcrumb list isn't sanitized and triggered xss.\n5. In the **/admin/myaccount** and pages under it, username or full name in breadcrumb list isn't sanitized and triggered xss.\n\n### Impact\nMalicious users can tamper with the control panel.\n\n### PoC\n#### 1. In the **/admin/categories** page, category title isn't sanitized and triggered xss.\n```\n1. Access to the Settings -\u003e Categories ( /admin/settings/categories )\n2. Create new category group\n3. Access to the Categories page ( /admin/categories/ )\n4. Push the New category button\n5. Input the Title column : xss\u003cscript\u003ealert('xss')\u003c/script\u003e\n6. Push the Create Category or Save button\n7. Access to the Categories page again and it triggers xss\n``` \n![image](https://github.com/craftcms/cms/assets/83068208/a1b2890e-731b-4fc4-b189-26591f4486fd)\n![image](https://github.com/craftcms/cms/assets/83068208/4e0f35c7-fbb0-4d38-a0b5-9e28750ff706)\n![image](https://github.com/craftcms/cms/assets/83068208/e046b9db-d83c-4f81-ad91-165c5afedeb9)\n\n#### 2. In the category edit page under the **/admin/categories/**, category title in breadcrumb list isn't sanitized and triggered xss.\n```\n1. Access to the Settings -\u003e Categories ( /admin/settings/categories )\n2. Create new category group\n3. Access to the Categories page ( /admin/categories/ )\n4. Push the New category button\n5. Input the Title column : xss\u003cscript\u003ealert('xss')\u003c/script\u003e\n6. Push the Create Category or Save button\n7. Access to the Category edit page again and it triggers xss\n``` \n![image](https://github.com/craftcms/cms/assets/83068208/a1b2890e-731b-4fc4-b189-26591f4486fd)\n![image](https://github.com/craftcms/cms/assets/83068208/f7543a11-58eb-4099-9ee2-3461816c52ea)\n![image](https://github.com/craftcms/cms/assets/83068208/f01bbb80-4417-42ca-bf51-b38860f6c74a)\n\n#### 3. In the **/admin/entries** page, entry title isn't sanitized and triggered xss.\n```\n1. Access to the Settings -\u003e Entry Types ( /admin/settings/entry-types )\n2. Create new entry type\n3. Access to the Settings -\u003e Sections ( /admin/settings/sections )\n4. Create new section\n5. Access to the Entries page ( /admin/entries )\n6. Push the New entry button\n7. Input the Title column : xss\u003cscript\u003ealert('xss')\u003c/script\u003e\n8. Push the Create entry or Save button\n9. Access to the Entries page again and it triggers xss\n``` \n![image](https://github.com/craftcms/cms/assets/83068208/ba700899-947f-4421-a1b7-3f0cc2c0da30)\n![image](https://github.com/craftcms/cms/assets/83068208/b255a999-e48c-46be-b732-4482ea9cee9a)\n![image](https://github.com/craftcms/cms/assets/83068208/445d8e0c-71b6-49c7-8f4a-37541dcc9c85)\n\n#### 4. In the entry edit page under the **/admin/entries/**, entry title in breadcrumb list isn't sanitized and triggered xss.\n```\n1. Access to the Settings -\u003e Entry Types ( /admin/settings/entry-types )\n2. Create new entry type\n3. Access to the Settings -\u003e Sections ( /admin/settings/sections )\n4. Create new section\n5. Access to the Entries page ( /admin/entries )\n6. Push the New entry button\n7. Input the Title column : xss\u003cscript\u003ealert('xss')\u003c/script\u003e\n8. Push the Create entry or Save button\n9. Access to the Entriy edit page again and it triggers xss\n``` \n![image](https://github.com/craftcms/cms/assets/83068208/ba700899-947f-4421-a1b7-3f0cc2c0da30)\n![image](https://github.com/craftcms/cms/assets/83068208/a59a122b-b9e7-4695-be13-eb8a1c2d36df)\n![image](https://github.com/craftcms/cms/assets/83068208/b0d27446-7ac6-47e7-ac02-20c924698b13)\n\n#### 5. In the **/admin/myaccount** and pages under it, username or full name in breadcrumb list isn't sanitized and triggered xss.\n```\n1. Access to the My Account Page ( /admin/myaccount )\n2. Input the Full Name column : xss\u003cscript\u003ealert('xss')\u003c/script\u003e\n3. Push the the Save button\n4. Access to the My Account page ( /admin/myaccount ) or pages under it ( /admin/myaccount/addresses , /admin/myaccount/preferences , etc.) and it triggers xss\n``` \n![image](https://github.com/craftcms/cms/assets/83068208/3be45bdd-0757-42a8-bc5d-320ab2339fd0)\n![image](https://github.com/craftcms/cms/assets/83068208/e1be7446-1c54-42bc-af9a-a8ac81a2d7bf)\n![image](https://github.com/craftcms/cms/assets/83068208/5fa06b26-fecd-40f5-bc8b-171f881f8a2a)","status":"published","published":"2024-09-09T18:18:28Z","modified":"2024-09-09T19:30:16Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-79","CWE-80"],"updated_at":"2026-11-02T14:38:01.080229Z"}],"nvd":[{"id":"CVE-2024-45406","description":"Craft is a content management system (CMS). Craft CMS 5 stored XSS can be triggered by the breadcrumb list and title fields with user input.","status":"published","published":"2024-09-09T17:15:13.18Z","modified":"2026-06-17T07:54:09.313Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79","CWE-80"],"updated_at":"2026-11-02T14:10:25.561537Z"}],"osv":[{"id":"CVE-2024-45406","title":"Craft CMS stored XSS in breadcrumb list and title fields","description":"Craft is a content management system (CMS). Craft CMS 5 stored XSS can be triggered by the breadcrumb list and title fields with user input.","status":"published","published":"2024-09-09T16:46:26.948Z","modified":"2026-10-28T02:30:29.729505804Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-79","CWE-80"],"updated_at":"2026-11-02T15:44:42.790566Z"},{"id":"GHSA-28h4-788g-rh42","title":"Craft CMS vulnerable to stored XSS in breadcrumb list and title fields","description":"### Summary\nMultiple Stored XSS can be triggered by the breadcrumb list and title fields with user input.\n\n### Details\n1. In the **/admin/categories** page, category title isn't sanitized and triggered xss.\n2. In the category edit page under the **/admin/categories/**, category title in breadcrumb list isn't sanitized and triggered xss.\n3. In the **/admin/entries** page, entry title isn't sanitized and triggered xss.\n4. In the entry edit page under the **/admin/entries/**, entry title in breadcrumb list isn't sanitized and triggered xss.\n5. In the **/admin/myaccount** and pages under it, username or full name in breadcrumb list isn't sanitized and triggered xss.\n\n### Impact\nMalicious users can tamper with the control panel.\n\n### PoC\n#### 1. In the **/admin/categories** page, category title isn't sanitized and triggered xss.\n```\n1. Access to the Settings -\u003e Categories ( /admin/settings/categories )\n2. Create new category group\n3. Access to the Categories page ( /admin/categories/ )\n4. Push the New category button\n5. Input the Title column : xss\u003cscript\u003ealert('xss')\u003c/script\u003e\n6. Push the Create Category or Save button\n7. Access to the Categories page again and it triggers xss\n``` \n![image](https://github.com/craftcms/cms/assets/83068208/a1b2890e-731b-4fc4-b189-26591f4486fd)\n![image](https://github.com/craftcms/cms/assets/83068208/4e0f35c7-fbb0-4d38-a0b5-9e28750ff706)\n![image](https://github.com/craftcms/cms/assets/83068208/e046b9db-d83c-4f81-ad91-165c5afedeb9)\n\n#### 2. In the category edit page under the **/admin/categories/**, category title in breadcrumb list isn't sanitized and triggered xss.\n```\n1. Access to the Settings -\u003e Categories ( /admin/settings/categories )\n2. Create new category group\n3. Access to the Categories page ( /admin/categories/ )\n4. Push the New category button\n5. Input the Title column : xss\u003cscript\u003ealert('xss')\u003c/script\u003e\n6. Push the Create Category or Save button\n7. Access to the Category edit page again and it triggers xss\n``` \n![image](https://github.com/craftcms/cms/assets/83068208/a1b2890e-731b-4fc4-b189-26591f4486fd)\n![image](https://github.com/craftcms/cms/assets/83068208/f7543a11-58eb-4099-9ee2-3461816c52ea)\n![image](https://github.com/craftcms/cms/assets/83068208/f01bbb80-4417-42ca-bf51-b38860f6c74a)\n\n#### 3. In the **/admin/entries** page, entry title isn't sanitized and triggered xss.\n```\n1. Access to the Settings -\u003e Entry Types ( /admin/settings/entry-types )\n2. Create new entry type\n3. Access to the Settings -\u003e Sections ( /admin/settings/sections )\n4. Create new section\n5. Access to the Entries page ( /admin/entries )\n6. Push the New entry button\n7. Input the Title column : xss\u003cscript\u003ealert('xss')\u003c/script\u003e\n8. Push the Create entry or Save button\n9. Access to the Entries page again and it triggers xss\n``` \n![image](https://github.com/craftcms/cms/assets/83068208/ba700899-947f-4421-a1b7-3f0cc2c0da30)\n![image](https://github.com/craftcms/cms/assets/83068208/b255a999-e48c-46be-b732-4482ea9cee9a)\n![image](https://github.com/craftcms/cms/assets/83068208/445d8e0c-71b6-49c7-8f4a-37541dcc9c85)\n\n#### 4. In the entry edit page under the **/admin/entries/**, entry title in breadcrumb list isn't sanitized and triggered xss.\n```\n1. Access to the Settings -\u003e Entry Types ( /admin/settings/entry-types )\n2. Create new entry type\n3. Access to the Settings -\u003e Sections ( /admin/settings/sections )\n4. Create new section\n5. Access to the Entries page ( /admin/entries )\n6. Push the New entry button\n7. Input the Title column : xss\u003cscript\u003ealert('xss')\u003c/script\u003e\n8. Push the Create entry or Save button\n9. Access to the Entriy edit page again and it triggers xss\n``` \n![image](https://github.com/craftcms/cms/assets/83068208/ba700899-947f-4421-a1b7-3f0cc2c0da30)\n![image](https://github.com/craftcms/cms/assets/83068208/a59a122b-b9e7-4695-be13-eb8a1c2d36df)\n![image](https://github.com/craftcms/cms/assets/83068208/b0d27446-7ac6-47e7-ac02-20c924698b13)\n\n#### 5. In the **/admin/myaccount** and pages under it, username or full name in breadcrumb list isn't sanitized and triggered xss.\n```\n1. Access to the My Account Page ( /admin/myaccount )\n2. Input the Full Name column : xss\u003cscript\u003ealert('xss')\u003c/script\u003e\n3. Push the the Save button\n4. Access to the My Account page ( /admin/myaccount ) or pages under it ( /admin/myaccount/addresses , /admin/myaccount/preferences , etc.) and it triggers xss\n``` \n![image](https://github.com/craftcms/cms/assets/83068208/3be45bdd-0757-42a8-bc5d-320ab2339fd0)\n![image](https://github.com/craftcms/cms/assets/83068208/e1be7446-1c54-42bc-af9a-a8ac81a2d7bf)\n![image](https://github.com/craftcms/cms/assets/83068208/5fa06b26-fecd-40f5-bc8b-171f881f8a2a)","status":"published","published":"2024-09-09T18:18:28Z","modified":"2024-09-09T19:46:49.206601Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"},{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L","level":"medium"}],"cwes":["CWE-79","CWE-80"],"updated_at":"2026-11-02T15:46:33.956911Z"}]}}