Log in Start free

Vulnerability · Published Mar 11, 2026 · Assigned by GitHub_M

CVE-2026-31859Craft has Reflective XSS via incomplete return URL sanitization

Medium 6.9

In plain English

A medium-severity cross-site scripting in cms from craftcms. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.9Medium
Exploit odds (30 days)0.2%top 87.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Craft is a content management system (CMS). The fix for CVE-2025-35939 in craftcms/cms introduced a strip_tags() call in src/web/User.php to sanitize return URLs before they are stored in the session. However, strip_tags() only removes HTML tags (angle brackets) -- it does not inspect or filter URL schemes. Payloads like javascript:alert(document.cookie) contain no HTML tags and pass through strip_tags() completely unmodified, enabling reflected XSS when the return URL is rendered in an href attribute. This vulnerability is fixed in 5.9.7 and 4.17.3.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistcraftcms/cms4.17.3GHSA-fvwq-45qv-xvhv
Packagistcraftcms/cms5.9.7GHSA-fvwq-45qv-xvhv

Affected products (as reported)

VendorProductVersions
craftcms cms >= 4.15.3, < 4.17.3>= 5.7.5, < 5.9.7

Weakness: CWE-79, CWE-116 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References