6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-31859

CVE-2026-31859: Craft has Reflective XSS via incomplete return URL sanitization

Craft is a content management system (CMS). The fix for CVE-2025-35939 in craftcms/cms introduced a strip_tags() call in src/web/User.php to sanitize return URLs before they are stored in the session. However, strip_tags() only removes HTML tags (angle brackets) -- it does not inspect or filter URL schemes. Payloads like javascript:alert(document.cookie) contain no HTML tags and pass through strip_tags() completely unmodified, enabling reflected XSS when the return URL is rendered in an href attribute. This vulnerability is fixed in 5.9.7 and 4.17.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-31859

CVE-2026-31859:

6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
craftcms/cms	composer	>= 4.15.3, <= 4.17.2	4.17.3
craftcms/cms	composer	>= 5.7.5, <= 5.9.6	5.9.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the setReturnUrl function within the craft\web\User class, located in src/web/User.php. The function was responsible for setting a return URL, but it used an inadequate sanitization method, strip_tags(). This function only removes HTML tags, leaving other dangerous URL schemes like javascript: and data: untouched. An attacker could craft a URL with a malicious returnUrl parameter, which would be processed by setReturnUrl and stored. When this URL was later used in a link on the page, clicking it would execute the embedded JavaScript, leading to a reflected XSS attack. The provided patch addresses this by adding a check to validate the URL scheme, ensuring that only http and https are allowed, thus neutralizing the XSS vector.

Vulnerable functions

craft\web\User::setReturnUrl

src/web/User.php

The `setReturnUrl` function in `src/web/User.php` was vulnerable to reflected XSS. The initial fix for a previous vulnerability introduced the use of `strip_tags()` to sanitize the return URL. However, `strip_tags()` only removes HTML tags and does not validate URL schemes. This allowed attackers to bypass the sanitization with payloads like `javascript:alert(1)` which do not contain any HTML tags. The vulnerable function processed this malicious input, which was then rendered in an `href` attribute, leading to XSS.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.