CVE-2026-56383: Craftcms/cms Cross-Site Scripting Vulnerability
LOWCVE-2026-56383 is a LOW cross-site scripting vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')) affecting Craftcms/cms libraries in the Packagist ecosystem. The issue involves craft cms has stored xss in table field in its "row heading" column type. Remediation is available by upgrading affected packages to version 4.16.19, 5.8.23.
CVE-2026-56383 at a Glance
How to Fix CVE-2026-56383
To remediate this vulnerability, upgrade all affected Craftcms/cms dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade craftcms/cms to 4.16.19Upgrade craftcms/cms to 5.8.23Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for craftcms/cmsHow to Check if You Are Affected
To determine whether your application is affected by CVE-2026-56383, inspect your project dependencies for Craftcms/cms:
inspect dependencies for craftcms/cmsAnalyze the terminal output to locate any version of Craftcms/cms in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 4.16.19), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), where the product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. In Craftcms/cms, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-56383 Affected Craftcms/cms Versions
2 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
craftcms/cms
|
Packagist |
≥ 4.5.0-beta.1
< 4.16.19
|
4.16.19
|
|
craftcms/cms
|
Packagist |
≥ 5.0.0-RC1
< 5.8.23
|
5.8.23
|
References
Frequently Asked Questions
What is CVE-2026-56383?
Which Craftcms/cms versions are affected?
What version fixes CVE-2026-56383?
Is craftcms/cms affected?
What CWE is associated with CVE-2026-56383?
How can I check Packagist dependencies for CVE-2026-56383?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-6j87-m5qx-9fqp",
"modified" : "2026-08-06T20:47:21Z",
"published" : "2026-02-25T19:11:31Z",
"aliases" : [ "CVE-2026-56383" ],
"summary" : "Craft CMS has Stored XSS in Table Field in its \"Row Heading\" Column Type",
"details" : "A stored Cross-site Scripting (XSS) vulnerability exists in the `editableTable.twig` component when using the `Row Heading` column type. The application fails to sanitize input within row headings, allowing an attacker to execute arbitrary JavaScript when another user views a page with the malicious table field.\n\n## Prerequisites\n* An administrator account\n* `allowAdminChanges` must be enabled in production, which is [against security recommendations](https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production).\n\n## Steps to Reproduce\n1. Navigate to **Settings** → **Fields** and create a new field with Type: **Table**\n1. Add a **Column Heading** and set **Column Type** to `Row Heading`\n1. In **Default Values** section, add a row with the following payload:\n ```html\n <img src=x onerror=\"alert('XSS')\">\n ```\n1. Enable `Static Rows`\n1. Use the field in any object (e.g., user profile fields) → then visit any user’s profile\n1. Notice the XSS execution\n\n## Resources\n\nhttps://github.com/craftcms/cms/commit/7b372de262b8d9d2ce859f32780c3715719b6f5a",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Packagist",
"name" : "craftcms/cms"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "4.5.0-beta.1"
}, {
"fixed" : "4.16.19"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 4.16.18"
}
}, {
"package" : {
"ecosystem" : "Packagist",
"name" : "craftcms/cms"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "5.0.0-RC1"
}, {
"fixed" : "5.8.23"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 5.8.22"
}
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/craftcms/cms/security/advisories/GHSA-6j87-m5qx-9fqp"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-56383"
}, {
"type" : "WEB",
"url" : "https://github.com/craftcms/cms/commit/7b372de262b8d9d2ce859f32780c3715719b6f5a"
}, {
"type" : "WEB",
"url" : "https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/craftcms/cms"
}, {
"type" : "WEB",
"url" : "https://github.com/craftcms/cms/releases/tag/4.16.19"
}, {
"type" : "WEB",
"url" : "https://github.com/craftcms/cms/releases/tag/5.8.23"
}, {
"type" : "WEB",
"url" : "https://www.vulncheck.com/advisories/craft-cms-stored-xss-in-table-field-via-row-heading-column-type"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-79" ],
"severity" : "LOW",
"github_reviewed" : true,
"github_reviewed_at" : "2026-02-25T19:11:31Z",
"nvd_published_at" : null
}
}