CVE-2026-72787 in CraftCMS
Summary
by MITRE • 08/12/2026
Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts can inject malicious JavaScript that executes in the browser of any higher-privileged user viewing the affected element, allowing account creation and other authenticated actions.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
This vulnerability exists within Craft CMS versions prior to 5.10.8 and represents a critical stored cross-site scripting flaw that specifically targets the control panel interface elements. The issue manifests when draft names are displayed in element chips and cards without proper HTML encoding, creating an environment where malicious input can persist and execute in the browser context of other users. The vulnerability is particularly dangerous because it allows attackers with low privilege levels to escalate their capabilities significantly by injecting JavaScript code that executes whenever higher-privileged users view affected elements.
The technical implementation of this flaw involves the improper handling of user-supplied input within the control panel's rendering logic for draft names. When users create drafts, they can provide arbitrary content including HTML and JavaScript within the draft name field, which then gets rendered directly into the element chips and cards without appropriate sanitization or encoding. This stored XSS vulnerability operates through the standard browser execution model where the injected script code executes in the context of any user who views the affected elements, regardless of their privilege level. The vulnerability is classified under CWE-79 as a failure to sanitize user input before rendering it into web pages, which represents one of the most common and dangerous categories of web application vulnerabilities.
The operational impact of this vulnerability extends beyond simple script execution, as it allows attackers to perform authenticated actions on behalf of other users with higher privileges. When malicious JavaScript executes in the browser context of administrative users, it can create new accounts, modify existing content, access sensitive data, or perform any action permitted by the compromised user's permissions. The attack vector requires a low-privilege user to have the ability to create element drafts, which is often a standard capability within Craft CMS environments, making this vulnerability particularly concerning as it can be exploited by users with minimal access rights. This scenario aligns with ATT&CK technique T1059.007 for Command and Scripting Interpreter: JavaScript, where attackers leverage legitimate browser capabilities to execute malicious code against other users.
The remediation strategy for this vulnerability involves implementing proper HTML encoding of all user-supplied content before rendering it in the control panel interface elements. Craft CMS version 5.10.8 addresses this by ensuring that draft names and other user-provided text are properly encoded when displayed in element chips and cards, preventing malicious scripts from executing. Organizations should immediately upgrade to version 5.10.8 or later to mitigate this risk, as the vulnerability can be exploited without requiring any special privileges beyond the ability to create drafts. Additionally, administrators should review their user access controls to limit draft creation capabilities where possible, though this does not eliminate the vulnerability itself since it requires only basic user permissions to exploit. The fix demonstrates proper input validation and output encoding practices that align with OWASP Top Ten security recommendations for preventing XSS vulnerabilities in web applications.