{"id":"CVE-2026-27126","aliases":["EUVD-2026-7406","GHSA-3jh3-prx3-w6wc"],"status":"published","title":"Craft CMS has Stored XSS in Table Field via \"HTML\" Column Type","description":"Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, a stored Cross-site Scripting (XSS) vulnerability exists in the `editableTable.twig` component when using the `html` column type. The application fails to sanitize the input, allowing an attacker to execute arbitrary JavaScript when another user views a page with the malicious table field. In order to exploit the vulnerability, an attacker must have an administrator account, and `allowAdminChanges` must be enabled in production, which is against Craft's security recommendations. Versions 4.16.19 and 5.8.23 patch the issue.","severity":{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00246,"percentile":0.1594,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-02-23T22:15:03Z","modified":"2026-10-28T02:30:53Z","fixes":[{"ecosystem":"Packagist","package":"craftcms/cms","fixed_in":["4.16.19","5.8.23"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"craftcms/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0-RC1"},{"last_affected":"4.16.18"},{"fixed":"4.16.19"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"craftcms/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0-RC1"},{"last_affected":"5.8.22"},{"fixed":"5.8.23"}]}]},{"source":"osv","ecosystem":"Packagist","package":"craftcms/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0-RC1"},{"fixed":"4.16.19"}]}],"versions":["4.10.0","4.10.0-beta.1","4.10.0-beta.2","4.10.1","4.10.2","4.10.3","4.10.4","4.10.5","4.10.6","4.10.7","4.10.8","4.11.0","4.11.0.1","4.11.0.2","4.11.1","4.11.2","4.11.3","4.11.4","4.11.5","4.12.0","4.12.1","4.12.2","4.12.3","4.12.4","4.12.4.1","4.12.5","4.12.6","4.12.6.1","4.12.7","4.12.8","4.12.9","4.13.0","4.13.1","4.13.1.1","4.13.10","4.13.2","4.13.3","4.13.4","4.13.5","4.13.6","4.13.7","4.13.8","4.13.9","4.14.0","4.14.0.1","4.14.0.2","4.14.1","4.14.10","4.14.11","4.14.11.1","4.14.12","4.14.13","4.14.14","4.14.15","4.14.2","4.14.3","4.14.4","4.14.5","4.14.6","4.14.7","4.14.8","4.14.8.1","4.14.9","4.15.0","4.15.0-beta.1","4.15.0-beta.2","4.15.0.1","4.15.0.2","4.15.1","4.15.2","4.15.3","4.15.4","4.15.5","4.15.6","4.15.6.1","4.15.6.2","4.15.7","4.16.0","4.16.1","4.16.10","4.16.11","4.16.12","4.16.13","4.16.14","4.16.15","4.16.16","4.16.17","4.16.18","4.16.2","4.16.3","4.16.4","4.16.5","4.16.6","4.16.6.1","4.16.7","4.16.8","4.16.9","4.16.9.1","4.5.0","4.5.1","4.5.10","4.5.11","4.5.11.1","4.5.12","4.5.13","4.5.14","4.5.15","4.5.2","4.5.3","4.5.4","4.5.5","4.5.6","4.5.6.1","4.5.7","4.5.8","4.5.9","4.6.0","4.6.0-RC1","4.6.1","4.7.0","4.7.1","4.7.2","4.7.2.1","4.7.3","4.7.4","4.8.0","4.8.1","4.8.10","4.8.11","4.8.2","4.8.3","4.8.4","4.8.5","4.8.6","4.8.7","4.8.8","4.8.9","4.9.0","4.9.1","4.9.2","4.9.3","4.9.4","4.9.5","4.9.6","4.9.7"]},{"source":"osv","ecosystem":"Packagist","package":"craftcms/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0-RC1"},{"fixed":"5.8.23"}]}],"versions":["5.0.0","5.0.0-RC1","5.0.1","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.1.0","5.1.1","5.1.10","5.1.2","5.1.3","5.1.4","5.1.5","5.1.6","5.1.7","5.1.8","5.1.9","5.2.0","5.2.0-beta.1","5.2.0-beta.2","5.2.0-beta.3","5.2.0-beta.4","5.2.0-beta.5","5.2.0-beta.6","5.2.1","5.2.10","5.2.2","5.2.3","5.2.4","5.2.4.1","5.2.5","5.2.6","5.2.7","5.2.8","5.2.9","5.3.0","5.3.0-beta.1","5.3.0-beta.2","5.3.0.1","5.3.0.2","5.3.0.3","5.3.1","5.3.2","5.3.3","5.3.4","5.3.5","5.3.6","5.4.0","5.4.0.1","5.4.1","5.4.10","5.4.10.1","5.4.2","5.4.3","5.4.4","5.4.5","5.4.5.1","5.4.6","5.4.7","5.4.7.1","5.4.8","5.4.9","5.5.0","5.5.0.1","5.5.1","5.5.1.1","5.5.10","5.5.2","5.5.3","5.5.4","5.5.5","5.5.6","5.5.6.1","5.5.7","5.5.8","5.5.9","5.6.0","5.6.0.1","5.6.0.2","5.6.1","5.6.10","5.6.10.1","5.6.10.2","5.6.11","5.6.12","5.6.13","5.6.14","5.6.15","5.6.16","5.6.17","5.6.2","5.6.3","5.6.4","5.6.5","5.6.5.1","5.6.6","5.6.7","5.6.8","5.6.9","5.6.9.1","5.7.0","5.7.0-beta.1","5.7.0-beta.2","5.7.1","5.7.1.1","5.7.10","5.7.11","5.7.2","5.7.3","5.7.4","5.7.5","5.7.6","5.7.7","5.7.8","5.7.8.1","5.7.8.2","5.7.9","5.8.0","5.8.1","5.8.10","5.8.11","5.8.12","5.8.13","5.8.13.1","5.8.13.2","5.8.14","5.8.15","5.8.16","5.8.17","5.8.18","5.8.19","5.8.2","5.8.20","5.8.21","5.8.22","5.8.3","5.8.4","5.8.5","5.8.6","5.8.7","5.8.8","5.8.9"]}],"products":[{"vendor":"craftcms","product":"cms"},{"vendor":"craftcms","product":"craft_cms"},{"vendor":"statamic","product":"cms"}],"references":[{"url":"https://github.com/craftcms/cms/security/advisories/GHSA-3jh3-prx3-w6wc","tags":["x_refsource_CONFIRM","Third Party Advisory","advisory","web"]},{"url":"https://github.com/craftcms/cms/commit/f5d488d9bb6eff7670ed2c2fe30e15692e92c52b","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27126","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3jh3-prx3-w6wc"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27126.json","tags":["advisory"]},{"url":"https://github.com/craftcms/cms","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-27126","title":"Craft CMS has Stored XSS in Table Field via \"HTML\" Column Type","description":"Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, a stored Cross-site Scripting (XSS) vulnerability exists in the `editableTable.twig` component when using the `html` column type. The application fails to sanitize the input, allowing an attacker to execute arbitrary JavaScript when another user views a page with the malicious table field. In order to exploit the vulnerability, an attacker must have an administrator account, and `allowAdminChanges` must be enabled in production, which is against Craft's security recommendations. Versions 4.16.19 and 5.8.23 patch the issue.","status":"published","published":"2026-02-24T02:30:04.882Z","modified":"2026-02-24T19:35:38.348Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:19:48.826324Z"}],"euvd":[{"id":"EUVD-2026-7406","description":"Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, a stored Cross-site Scripting (XSS) vulnerability exists in the `editableTable.twig` component when using the `html` column type. The application fails to sanitize the input, allowing an attacker to execute arbitrary JavaScript when another user views a page with the malicious table field. In order to exploit the vulnerability, an attacker must have an administrator account, and `allowAdminChanges` must be enabled in production, which is against Craft's security recommendations. Versions 4.16.19 and 5.8.23 patch the issue.","status":"published","published":"2026-02-24T02:30:04Z","modified":"2026-02-24T19:35:38Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:48:29.551855Z"}],"ghsa":[{"id":"GHSA-3jh3-prx3-w6wc","title":"Craft CMS has Stored XSS in Table Field via \"HTML\" Column Type","description":"A stored Cross-site Scripting (XSS) vulnerability exists in the `editableTable.twig` component when using the `html` column type. The application fails to sanitize the input, allowing an attacker to execute arbitrary JavaScript when another user views a page with the malicious table field.\n\n## Prerequisites\n* An administrator account\n* `allowAdminChanges` must be enabled in production, which is [against our security recommendations](https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production).\n\n## Steps to Reproduce\n1. Navigate to **Settings** → **Fields** and create a new field with Type: **Table**\n1. Add a **Column Heading** and set **Column Type** to `Single-line text`\n    - **Note:** The vulnerable **Column Type** is `html`, but it's not available in the UI dropdown.\n1. In **Default Values** section, add a row with the following payload:\n    ```html\n    \u003cimg src=x onerror=\"alert('XSS')\"\u003e\n    ```\n1. Enable `Static Rows`\n1. Intercept the **Save Field** request using a proxy tool (e.g., Burp Suite) or use `cURL` directly\n1. Modify the request body and change the `types[craft-fields-Table][columns][col3][type]` parameter from `singleline` to `html`\n1. Forward the request to save the field\n1. Use the field in any object (e.g. user profile fields) → then visit the any user's profile\n1. Notice the XSS execution\n1. The XSS will also trigger when an administrator attempts to edit this field, as the malicious payload is executed within the field configuration page, too.\n\n## Resources\n\nhttps://github.com/craftcms/cms/commit/f5d488d9bb6eff7670ed2c2fe30e15692e92c52b","status":"published","published":"2026-02-23T22:15:03Z","modified":"2026-02-24T16:08:44Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:39:27.949248Z"}],"nvd":[{"id":"CVE-2026-27126","description":"Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, a stored Cross-site Scripting (XSS) vulnerability exists in the `editableTable.twig` component when using the `html` column type. The application fails to sanitize the input, allowing an attacker to execute arbitrary JavaScript when another user views a page with the malicious table field. In order to exploit the vulnerability, an attacker must have an administrator account, and `allowAdminChanges` must be enabled in production, which is against Craft's security recommendations. Versions 4.16.19 and 5.8.23 patch the issue.","status":"published","published":"2026-02-24T03:16:02.267Z","modified":"2026-06-17T10:26:42.777Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:06.63895Z"}],"osv":[{"id":"CVE-2026-27126","title":"Craft CMS has Stored XSS in Table Field via \"HTML\" Column Type","description":"Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, a stored Cross-site Scripting (XSS) vulnerability exists in the `editableTable.twig` component when using the `html` column type. The application fails to sanitize the input, allowing an attacker to execute arbitrary JavaScript when another user views a page with the malicious table field. In order to exploit the vulnerability, an attacker must have an administrator account, and `allowAdminChanges` must be enabled in production, which is against Craft's security recommendations. Versions 4.16.19 and 5.8.23 patch the issue.","status":"published","published":"2026-02-24T02:30:04.882Z","modified":"2026-10-28T02:30:53.178893823Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:59.80315Z"},{"id":"GHSA-3jh3-prx3-w6wc","title":"Craft CMS has Stored XSS in Table Field via \"HTML\" Column Type","description":"A stored Cross-site Scripting (XSS) vulnerability exists in the `editableTable.twig` component when using the `html` column type. The application fails to sanitize the input, allowing an attacker to execute arbitrary JavaScript when another user views a page with the malicious table field.\n\n## Prerequisites\n* An administrator account\n* `allowAdminChanges` must be enabled in production, which is [against our security recommendations](https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production).\n\n## Steps to Reproduce\n1. Navigate to **Settings** → **Fields** and create a new field with Type: **Table**\n1. Add a **Column Heading** and set **Column Type** to `Single-line text`\n    - **Note:** The vulnerable **Column Type** is `html`, but it's not available in the UI dropdown.\n1. In **Default Values** section, add a row with the following payload:\n    ```html\n    \u003cimg src=x onerror=\"alert('XSS')\"\u003e\n    ```\n1. Enable `Static Rows`\n1. Intercept the **Save Field** request using a proxy tool (e.g., Burp Suite) or use `cURL` directly\n1. Modify the request body and change the `types[craft-fields-Table][columns][col3][type]` parameter from `singleline` to `html`\n1. Forward the request to save the field\n1. Use the field in any object (e.g. user profile fields) → then visit the any user's profile\n1. Notice the XSS execution\n1. The XSS will also trigger when an administrator attempts to edit this field, as the malicious payload is executed within the field configuration page, too.\n\n## Resources\n\nhttps://github.com/craftcms/cms/commit/f5d488d9bb6eff7670ed2c2fe30e15692e92c52b","status":"published","published":"2026-02-23T22:15:03Z","modified":"2026-02-24T16:19:51.928272Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:35.747385Z"}]}}