PT-2026-7146 · Craft · Craft

Mhe4Am · Published 2026-02-09 · Updated 2026-02-09 · CVE-2026-25496

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Craft versions 4.0.0-RC1 through 4.16.17 Craft versions 5.0.0-RC1 through 5.8.21

Description Craft is a platform for creating digital experiences. A stored Cross-Site Scripting (XSS) issue exists in the Number field type settings. The Prefix and Suffix fields are rendered using the |md|raw Twig filter without proper escaping, which allows for script execution when the Number field is displayed on users' profiles. The vulnerable fields are susceptible because of the lack of proper input sanitization.

Recommendations Update to Craft version 4.16.18 or later. Update to Craft version 5.8.22 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-25496

GHSA-9F5H-MMQ6-2X78

Affected Products

Craft

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25496.json · Exploit
• https://github.com/craftcms/cms/security/advisories/GHSA-9f5h-mmq6-2x78 · Patch
• https://github.com/craftcms/cms/commit/cb5fb0e979e72f315c9178fc031883d49527f513 · Patch
• https://osv.dev/vulnerability/GHSA-9f5h-mmq6-2x78 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25496 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25496 · Security Note
• https://github.com/craftcms/cms · Note
• https://github.com/craftcms/cms/releases/tag/5.8.22 · Note
• https://github.com/craftcms/cms/releases/tag/4.16.18 · Note
• https://twitter.com/_cvereports/status/2020998668040450237 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2020976225968157058 · Twitter Post
• https://twitter.com/CVEnew/status/2020959689068925395 · Twitter Post