CVE-2026-55793

Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5.9.22, an author-level control panel user can store a malicious JavaScript payload in an entry title. When an admin, or any control panel user with saveEntries for the same Structure section, drags another entry under the poisoned entry in table view, the payload executes in the victim’s session. The issue is exploitable because the title is escaped into data-title by the server, decoded again by the browser, read with jQuery .data('title'), and then concatenated into a new HTML string without attribute escaping. To exploit, an attacker must have an existing control panel account (Author role minimum), the victim must perform a drag operation (not just visit the page), and the victim’s session needs to be elevated at trigger time. This issue has been fixed in version 5.9.23.

• CWE-79

• https://github.com/craftcms/cms/commit/162321e899cc97517fb6f5a02b5528f549d0c6cc
• https://github.com/craftcms/cms/security/advisories/GHSA-xrqc-p465-2xvg
• https://github.com/craftcms/cms/security/advisories/GHSA-xrqc-p465-2xvg

Published

Jul 1, 2026

Last Modified

Jul 2, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55783NanaZip is the 7-Zip derivative intended for the modern Wind…2.4
• CVE-2026-55789Logto is the modern, open-source auth infrastructure for Saa…8.5
• CVE-2026-5579A vulnerability was determined in CodeAstro Online Classroom…6.3
• CVE-2026-55790Craft CMS is a content management system (CMS). In versions …7.4
• CVE-2026-55791Craft CMS is a content management system (CMS). Versions 4.0…6.9
• CVE-2026-55792Craft CMS is a content management system (CMS). In versions …6
• CVE-2026-55794Craft CMS is a content management system (CMS). In versions …8.7
• CVE-2026-55798Pillow is a Python imaging library. Prior to 12.3.0, Windows…4.5
• CVE-2026-55799Remote Code Execution Vulnerability in GraalScriptEngineCrea…9.8
• CVE-2026-5580A vulnerability was identified in CodeAstro Online Classroom…6.3
• CVE-2026-55803Improperly Controlled Modification of Dynamically-Determined…5.9
• CVE-2026-55804Improperly Controlled Modification of Dynamically-Determined…5.9