PT-2026-24687 · Craft Cms+2 · Cms+2
Angrybrad
·
Published
2026-03-11
·
Updated
2026-03-12
·
CVE-2026-31859
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
Name of the Vulnerable Software and Affected Versions
Craft versions prior to 5.9.7
Craft versions prior to 4.17.3
Description
The software is susceptible to a reflected cross-site scripting (XSS) issue. A fix intended to sanitize return URLs used
strip tags(), which only removes HTML tags but does not validate URL schemes. Payloads utilizing schemes like javascript: or data: bypass this sanitization, enabling malicious code execution when the return URL is rendered in an href attribute. Specifically, the setReturnUrl() function in src/web/User.php is affected. The issue arises because strip tags() operates on HTML syntax while the threat requires URL scheme validation. Exploitation involves crafting a malicious link containing a dangerous URL, such as https://target.example.com/?returnUrl=javascript:alert(document.cookie), and sending it to a victim. When the victim clicks the link, the malicious URL is stored in the session and subsequently rendered in an href attribute, leading to the execution of the attacker-controlled code. This can lead to session hijacking, data exfiltration, phishing, and cross-site request forgery (CSRF).Recommendations
Versions prior to 5.9.7 should be updated to version 5.9.7.
Versions prior to 4.17.3 should be updated to version 4.17.3.
Exploit
Fix
Improper Encoding or Escaping of Output
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Cms
Craft Cms
Craftcms/Cms