GHSA-3x4w-mxpf-fhqq

Source

https://github.com/advisories/GHSA-3x4w-mxpf-fhqq

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-3x4w-mxpf-fhqq/GHSA-3x4w-mxpf-fhqq.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-3x4w-mxpf-fhqq

Aliases

CVE-2026-33051

Published

2026-03-18T12:58:23Z

Modified

2026-03-20T21:35:34Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator

Summary

Craft CMS Vulnerable to Stored XSS in Revision Context Menu

Details

The revision/draft context menu in the element editor renders the creator’s fullName as raw HTML due to the use of Template::raw() combined with Craft::t() string interpolation. A low-privileged control panel user (e.g., Author) can set their fullName to an XSS payload via the profile editor, then create an entry with two saves.

If an administrator is logged in and executes a specifically crafted payload while an elevated session is active, the attacker’s account can be elevated to administrator.

Users should update to Craft 5.9.11 with the patch to mitigate the issue.

Database specific

{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-18T12:58:23Z",
    "nvd_published_at":  "2026-03-20T06:16:12Z",
    "severity":  "MODERATE"
}

References

Affected packages

Packagist / craftcms/cms

Package

Name: craftcms/cms
Purl: pkg:composer/craftcms/cms

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.9.0-beta.1

Fixed

5.9.11

Affected versions

5.*

5.9.0-beta.1

5.9.0-beta.2

5.9.0

5.9.1

5.9.2

5.9.3

5.9.4

5.9.5

5.9.6

5.9.7

5.9.8

5.9.9

5.9.10

Database specific

last_known_affected_version_range

"<= 5.9.10"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-3x4w-mxpf-fhqq/GHSA-3x4w-mxpf-fhqq.json"