N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-6j87-m5qx-9fqp

GHSA-6j87-m5qx-9fqp: Craft CMS has Stored XSS in Table Field in its "Row Heading" Column Type

A stored Cross-site Scripting (XSS) vulnerability exists in the editableTable.twig component when using the Row Heading column type. The application fails to sanitize input within row headings, allowing an attacker to execute arbitrary JavaScript when another user views a page with the malicious table field.

Prerequisites

An administrator account
allowAdminChanges must be enabled in production, which is against security recommendations.

Steps to Reproduce

Navigate to Settings → Fields and create a new field with Type: Table
Add a Column Heading and set Column Type to Row Heading
In Default Values section, add a row with the following payload:
```
<img src=x onerror="alert('XSS')">
```
Enable Static Rows
Use the field in any object (e.g., user profile fields) → then visit any user’s profile
Notice the XSS execution

Resources

https://github.com/craftcms/cms/commit/7b372de262b8d9d2ce859f32780c3715719b6f5a

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-6j87-m5qx-9fqp

GHSA-6j87-m5qx-9fqp:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
craftcms/cms	composer	>= 4.5.0-beta.1, <= 4.16.18	4.16.19
craftcms/cms	composer	>= 5.0.0-RC1, <= 5.8.22	5.8.23

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided patch 7b372de262b8d9d2ce859f32780c3715719b6f5a clearly indicates that the stored XSS vulnerability is located in the _getInputHtml method of the craftcms\cms\fields\Table class. The diff shows that the developers added HTML encoding specifically for the 'heading' column type within this function. Before the patch, the value was taken directly from the $row[$colId] variable and placed into the output array, which was then rendered in the Twig template. This lack of output encoding is the root cause of the vulnerability. The _getInputHtml function is the precise location where the malicious input is processed and rendered, making it the key function that would appear in a runtime profile during exploitation.

Vulnerable functions

craftcms\cms\fields\Table::_getInputHtml

src/fields/Table.php

The vulnerability lies in the `_getInputHtml` function, which is responsible for generating the HTML for the table field's input. For columns with the type 'heading', the function previously used the raw value from the database without proper encoding. This allowed an attacker to inject malicious HTML and script content into the row heading, which would then be executed in the browser of anyone viewing the page containing the compromised table. The patch addresses this by using `Html::encode()` to sanitize the heading value before it is rendered, preventing the XSS attack.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-6j87-m5qx-9fqp: Craft CMS has Stored XSS in Table Field in its "Row Heading" Column Type

Prerequisites

Steps to Reproduce

Resources

GHSA-6j87-m5qx-9fqp:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Basic Information

Basic Information

Technical Details

GHSA-6j87-m5qx-9fqp: Craft CMS has Stored XSS in Table Field in its "Row Heading" Column Type

Prerequisites

Steps to Reproduce

Resources

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

N/A

N/A

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI