4.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25496

CVE-2026-25496: Craft has a stored XSS in Number Prefix & Suffix Fields

Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, a stored XSS vulnerability exists in the Number field type settings. The Prefix and Suffix fields are rendered using the |md|raw Twig filter without proper escaping, allowing script execution when the Number field is displayed on users' profiles. This issue is patched in versions 4.16.18 and 5.8.22.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25496

CVE-2026-25496:

4.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
craftcms/cms	composer	>= 5.0.0-RC1, <= 5.8.21	5.8.22
craftcms/cms	composer	>= 4.0.0-RC1, <= 4.16.17	4.16.18

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue in the 'Number' field type of Craft CMS. The root cause is the improper handling of user-provided 'Prefix' and 'Suffix' text in the field's settings. The provided patch, commit cb5fb0e979e72f315c9178fc031883d49527f513, directly points to the source of the vulnerability in the Twig template src/templates/_components/fieldtypes/Number/input.twig. The patch shows that the prefix and suffix variables were being rendered using |md(inlineOnly=true)|raw, which allows for raw HTML output. The fix involves adding encode=true to the md filter, which sanitizes the input.

While the flaw is in the template, the function that would appear in a runtime profile during exploitation is the one that renders this template. In Craft CMS, each field type has a corresponding class that handles its behavior, including how its input is rendered. For the 'Number' field, this is the craft\fields\Number class. The method responsible for generating the input HTML is getInputHtml(). This function takes the field's settings, including the potentially malicious prefix and suffix, and passes them to the vulnerable Twig template for rendering. Therefore, craft\fields\Number::getInputHtml is the key function that facilitates the XSS vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.