Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-55790: Craft CMS admin panel runs code from GitHub issue

CVE-2026-55790 · published 3 months ago

Summary

Versions 4.0.0‑RC1 through 4.17.15 and 5.0.0‑RC1 through 5.9.22 of Craft CMS let anyone with a GitHub account place JavaScript in an issue title. When an administrator uses the CraftSupport widget’s feedback screen and searches for that issue, the code runs in their browser session. Update to version 4.17.16 or 5.9.23 or later to stop this behavior.

What to do

Update craftcms cms to version 5.9.23.
Update craftcms cms to version 4.17.16.
Update craftcms craftcms/cms to version 5.9.23.
Update craftcms craftcms/cms to version 4.17.16.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	craftcms	cms	>= 5.0.0-RC1, < 5.9.23
composer	craftcms	cms	>= 5.0.0-RC1, < 5.9.22 >= 4.0.0-RC1, < 4.17.15 Fix: upgrade to 5.9.23
Packagist	craftcms	craftcms/cms	>= 5.0.0-RC1, < 5.9.23 >= 4.0.0-RC1, < 4.17.16 Fix: upgrade to 5.9.23

Original advisory text

Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget

Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5.9.22 and 4.0.0-RC1 through 4.17.15, an attacker with only a GitHub account can plant a JavaScript payload in a craftcms/cms issue title. When a Craft admin uses the CraftSupport widget’s "Give feedback" screen and types a search term that returns the poisoned issue, the payload executes in the admin’s control panel session. No control panel account or elevated privileges are required on the attacker’s side. This issue has been fixed in versions 4.17.16 and 5.9.23.

References

https://github.com/craftcms/cms/commit/6bbb66038a268552180ca5c8eed9f46ea25a4417 Patch
https://github.com/craftcms/cms/security/advisories/GHSA-24x4-j6x9-rfw5 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-55790 Vendor Advisory
https://github.com/advisories/GHSA-24x4-j6x9-rfw5
https://github.com/craftcms/cms Product
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55790... Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

9.1 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published1 Jul 2026

Updated22 Oct 2026

First seen2 Jul 2026

Sources

CVE-2026-55790 · NVD

CVE-2026-55790 · MITRE

GHSA-24x4-j6x9-rfw5 · GHSA

GHSA-24x4-j6x9-rfw5 · OSV

CVE-2026-55790 · OSV

Track software like this

Free during beta