CVE-2026-25491
Craft CMS Vulnerable to Stored XSS in Entry Types Name
Impact
## Summary Stored XSS via Entry Type names. The name is not sanitized when displayed in the Entry Types list. --- ## Proof of Concept ### Required Permissions (Attacker) - Admin access (only admins have access to the settings page) - `allowAdminChanges` is enabled in production, which is against our [security recommendations](https://craftcms.com/knowledge-base/securing-craft). ### Steps to Reproduce 1. Log in as an attacker. 2. Go to **Settings** -> **Entry Types** (`/admin/settings/entry-types`). 3. Create a new Entry Type. 4. Set **Name** to: ```html <img src=x onerror="alert('XSS-EntryTypes')" hidden> ``` 5. Save the Entry Type, and you’ll be redirected back to the entry types table automatically. 6. Notice the alert fires when the entry types table renders.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | craftcms/cms | >= 5.0.0-RC1, <= 5.8.21 | 5.8.22 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Craftcms | Craft Cms | from 5.0.0 before 5.8.21 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/craftcms/cms/commit/cfd6ba0e2ce1a59a02d75cae6558c4ace1ab8bd4
- https://github.com/craftcms/cms/releases/tag/5.8.22
- https://github.com/craftcms/cms/security/advisories/GHSA-7pr4-wx9w-mqwr
- https://github.com/advisories/GHSA-7pr4-wx9w-mqwr
- https://nvd.nist.gov/vuln/detail/CVE-2026-25491