CVE-2026-92590 in Craft CMS
Summary
by MITRE • 09/17/2026
Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in the Generated Fields feature that disables Twig autoescaping and fails to encode cached values. Content editors can inject malicious JavaScript through editable fields that executes in authenticated Control Panel sessions of higher-privileged users viewing element indexes.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/17/2026
Craft CMS versions ranging from 5.7.0 up to, but not including, version 5.10.13 are affected by a critical stored cross-site scripting vulnerability located within the Generated Fields feature. This security flaw stems from an improper neutralization of special elements during output rendering, specifically categorized under CWE-80 in the Common Weakness Enumeration framework. The core technical issue arises because the system disables Twig autoescaping for generated fields and fails to properly encode cached values before they are rendered back into the browser environment. By disabling this essential security mechanism, the application allows raw user-supplied input to be interpreted as executable code rather than static data when displayed within the administrative interface.
The operational impact of this vulnerability is significant because it enables content editors with lower privileges to inject malicious JavaScript payloads directly through editable fields. These payloads are stored in the database and subsequently executed whenever a higher-privileged user, such as an administrator or editor, views element indexes that utilize these generated fields. This scenario aligns closely with ATT&CK technique T1059.007, which covers command and scripting interpreter execution via web browsers. Because the script executes within the context of authenticated sessions for privileged users, attackers can hijack administrative accounts, steal session cookies, or perform actions on behalf of those users without their knowledge or consent.
The persistence of this threat is heightened by its stored nature, meaning a single successful injection point allows an attacker to compromise multiple victims over time as they interact with the affected content. The failure to encode cached values exacerbates the risk because even if input validation were partially effective at entry, the retrieval and display process bypasses necessary sanitization steps due to the disabled autoescaping feature. This creates a reliable vector for persistent access within the application environment.
To mitigate this vulnerability, organizations must immediately upgrade Craft CMS to version 5.10.13 or later where these encoding issues have been resolved. Until an upgrade is feasible, administrators should restrict access to content editing features and monitor user activity logs for anomalous behavior indicative of script injection attempts. Additionally, implementing strict Content Security Policy headers can help mitigate the impact by restricting the execution context of injected scripts, although upgrading remains the only definitive remediation strategy. Regular security audits focusing on input validation and output encoding practices are recommended to prevent similar weaknesses in custom modules or plugins that may interact with Twig templating engines.