PT-2026-51231 · Craft Cms · Cms

Mhe4Am · Published 2026-06-21 · Updated 2026-06-21 · CVE-2026-56383

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.5.0-beta.1 through 4.16.18 Craft CMS versions 5.0.0-RC1 through 5.8.22

Description A stored cross-site scripting (XSS) issue exists in the editableTable.twig component when utilizing the 'Row Heading' column type. The application does not properly sanitize input within row heading default values. This allows an attacker with an administrator account, provided that allowAdminChanges is enabled, to inject arbitrary JavaScript. The script executes when another user views a page containing the affected table field.

Recommendations Update to version 4.16.19 for versions in the 4.x branch. Update to version 5.8.23 for versions in the 5.x branch.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-56383

Affected Products

Cms

References · 5

• https://github.com/craftcms/cms/security/advisories/GHSA-6j87-m5qx-9fqp · Vendor Advisory
• https://github.com/craftcms/cms/commit/7b372de262b8d9d2ce859f32780c3715719b6f5a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-56383 · Security Note
• https://twitter.com/VulmonFeeds/status/2068726218430488913 · Twitter Post
• https://vulncheck.com/advisories/craft-cms-stored-xss-in-table-field-via-row-heading-column-type · Note