What’s Vulnerable › Vulnerabilities
CVE-2026-31859: Craft has Reflective XSS via incomplete return URL sanitization
- Severity: medium (CVSS 6.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-03-11 · updated 2026-06-17
- Weakness: CWE-79
Description
Craft is a content management system (CMS). The fix for CVE-2025-35939 in craftcms/cms introduced a strip_tags() call in src/web/User.php to sanitize return URLs before they are stored in the session. However, strip_tags() only removes HTML tags (angle brackets) -- it does not inspect or filter URL schemes. Payloads like javascript:alert(document.cookie) contain no HTML tags and pass through strip_tags() completely unmodified, enabling reflected XSS when the return URL is rendered in an href attribute. This vulnerability is fixed in 5.9.7 and 4.17.3.
Affected products
- craftcms cms: from 4.15.3 before 4.17.3; from 5.7.5 before 5.9.7 — fixed in 4.17.3, 5.9.7
How to fix
Upgrade to a fixed version: craftcms cms 4.17.3, 5.9.7. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-31859 or the next vulnerability affects your stack