PT-2026-54859 · Craft Cms · Craft Cms

Crypto-Cat · Published 2026-07-01 · Updated 2026-07-06 · CVE-2026-55790

Positive Technologies (AI Summary)

CVSS v4.0

7.4

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0-RC1 through 5.9.22 Craft CMS versions 4.0.0-RC1 through 4.17.15

Description An attacker with a GitHub account can inject a JavaScript payload into a craftcms/cms issue title. The payload executes within the control panel session of a Craft admin when they use the CraftSupport widget Give feedback screen and enter a search term that retrieves the poisoned issue. This process requires no control panel account or elevated privileges from the attacker.

Recommendations Update to version 5.9.23. Update to version 4.17.16.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-55790

GHSA-24X4-J6X9-RFW5

Affected Products

Craft Cms

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-55790 · Security Note
• https://osv.dev/vulnerability/GHSA-24x4-j6x9-rfw5 · Vendor Advisory
• https://github.com/craftcms/cms/security/advisories/GHSA-24x4-j6x9-rfw5 · Note
• https://github.com/craftcms/cms/commit/6bbb66038a268552180ca5c8eed9f46ea25a4417 · Note
• https://github.com/craftcms/cms · Note
• https://t.me/cveNotify/184239 · Telegram Post
• https://twitter.com/infoflowcloud/status/2072497014659555371 · Twitter Post
• https://t.me/cveNotify/185557 · Telegram Post
• https://twitter.com/CVEnew/status/2072495342038421798 · Twitter Post
• https://t.me/CVEtracker/58642 · Telegram Post