{"id":"CVE-2026-25491","aliases":["GHSA-7pr4-wx9w-mqwr"],"url":"https://o3.security/vulnerability/CVE-2026-25491","summary":"Craft has a Stored XSS in Entry Types Name","details":"## Summary\n\nStored XSS via Entry Type names. The name is not sanitized when displayed in the Entry Types list.\n\n---\n## Proof of Concept\n\n### Required Permissions (Attacker)\n\n- Admin access (only admins have access to the settings page)\n- `allowAdminChanges` is enabled in production, which is against our [security recommendations](https://craftcms.com/knowledge-base/securing-craft).\n\n### Steps to Reproduce\n1. Log in as an attacker.\n2. Go to **Settings** -> **Entry Types** (`/admin/settings/entry-types`).\n3. Create a new Entry Type.\n4. Set **Name** to:\n```html\n<img src=x onerror=\"alert('XSS-EntryTypes')\" hidden>\n```\n5. Save the Entry Type, and you’ll be redirected back to the entry types table automatically.\n6. Notice the alert fires when the entry types table renders.","published":"2026-02-09T19:25:29.690Z","modified":"2026-08-12T03:51:23.364246439Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"craftcms/cms","fixedVersion":"5.8.22"}],"fix":{"url":"https://github.com/craftcms/cms/commit/cfd6ba0e2ce1a59a02d75cae6558c4ace1ab8bd4","label":"craftcms/cms@cfd6ba0"},"references":[{"type":"WEB","url":"https://github.com/craftcms/cms/releases/tag/5.8.22"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25491.json"},{"type":"ADVISORY","url":"https://github.com/craftcms/cms/security/advisories/GHSA-7pr4-wx9w-mqwr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25491"},{"type":"FIX","url":"https://github.com/craftcms/cms/commit/cfd6ba0e2ce1a59a02d75cae6558c4ace1ab8bd4"},{"type":"PACKAGE","url":"https://github.com/craftcms/cms"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:23.364246439Z"}}