5.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27126

CVE-2026-27126: Craft CMS has Stored XSS in Table Field via "HTML" Column Type

Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, a stored Cross-site Scripting (XSS) vulnerability exists in the editableTable.twig component when using the html column type. The application fails to sanitize the input, allowing an attacker to execute arbitrary JavaScript when another user views a page with the malicious table field. In order to exploit the vulnerability, an attacker must have an administrator account, and allowAdminChanges must be enabled in production, which is against Craft's security recommendations. Versions 4.16.19 and 5.8.23 patch the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27126

CVE-2026-27126:

5.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
craftcms/cms	composer	>= 4.5.0-RC1, <= 4.16.18	4.16.19
craftcms/cms	composer	>= 5.0.0-RC1, <= 5.8.22	5.8.23

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored XSS in Craft CMS's Table field, caused by the application's failure to properly sanitize input when a column is set to the 'html' type. An attacker can set this type by intercepting and modifying the request to save a Table field, as 'html' is not an option in the UI.

The analysis of the provided patch f5d488d9bb6eff7670ed2c2fe30e15692e92c52b pinpoints the vulnerable functions within src/fields/Table.php.

craft\cms\fields\Table::validateColumns: This is the primary vulnerable function. The patch introduces validation to ensure that a column's type is within a predefined list of safe types. Before this change, the function lacked this validation, allowing an attacker to save a column with the type set to 'html'. This is the entry point for the vulnerability.
craft\cms\fields\Table::getSettingsHtml: The vulnerability report confirms that the XSS payload executes when an administrator edits the compromised field. This function generates the HTML for the field's settings page. It would read the field's configuration, including the malicious default value and the 'html' column type, and render it in a way that caused the browser to execute the script.
craft\cms\fields\Table::__construct: The patch removes code from the constructor that was intended to handle 'html' type columns by encoding their default values. This shows that the constructor was part of the code path that processed the malicious configuration. This attempted mitigation was removed in favor of disallowing the 'html' type altogether, indicating it was insufficient.

In an exploit scenario, these three functions would be invoked to process, store, and render the malicious data, making them key indicators in a runtime profile.

Vulnerable functions

craft\cms\fields\Table::validateColumns

src/fields/Table.php

This function was missing validation for the 'type' of a column. The patch adds a check to ensure that the column type is one of the predefined, safe types. Before the patch, an attacker could provide an unsupported and unsafe 'html' type, which would be stored in the database. This lack of validation is the root cause of the vulnerability.

craft\cms\fields\Table::getSettingsHtml

src/fields/Table.php

This function is responsible for rendering the settings UI for the Table field in the admin panel. The vulnerability description states that the XSS payload is executed on this page. The function renders the field's configuration, including the default values. When a column has the malicious 'html' type, this function (or a template it renders) would output the stored payload without proper escaping, causing the XSS.

craft\cms\fields\Table::__construct

src/fields/Table.php

The constructor for the Table field was involved in processing the field's configuration, including the default values. The patch removes a section of code that attempted to handle the 'html' column type by encoding its default values. This indicates that the constructor was part of the vulnerable code path that processed the malicious payload. The removal of this logic in favor of strictly validating the column type in `validateColumns` shows that this was an incorrect or incomplete mitigation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.