CVE-2026-31859 Craft has Reflective XSS via incomplete return URL sanitization
Attackers can execute arbitrary JavaScript in victim browsers via unsanitized return URLs, potentially stealing cookies or session data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31859?
CVE-2026-31859 is a medium-severity cross-site scripting vulnerability in Craftcms Craft Cms, published on 11 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Craft is a content management system (CMS). The fix for CVE-2025-35939 in craftcms/cms introduced a strip_tags() call in src/web/User.php to sanitize return URLs before they are stored in the session. However, strip_tags() only removes HTML tags (angle brackets) -- it does not inspect or filter URL schemes. Payloads like javascript:alert(document.cookie) contain no HTML tags and pass through strip_tags() completely unmodified, enabling reflected XSS when the return URL is rendered in an href attribute. This vulnerability is fixed in 5.9.7 and 4.17.3.
Which versions are affected by CVE-2026-31859?
4 open source packages ship an affected version, including craftcms/cms. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
craftcms/cms Packagist | From 4.15.3 | 4.17.3 |
craftcms/cms Packagist | From 4.15.3 | 4.17.3 |
craftcms/cms Packagist | From 5.7.5 | 5.9.7 |
craftcms/cms Packagist | From 5.7.5 | 5.9.7 |
Products include Craftcms Craft Cms.
How do I fix CVE-2026-31859?
Upgrade craftcms/cms to a fixed version for your release line: 4.17.3 or 5.9.7.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-31859 being exploited?
There is no known exploitation of CVE-2026-31859 in the wild and no public exploit code.
Other vulnerabilities in Craftcms Craft Cms
Sources
Also known as GHSA-fvwq-45qv-xvhv.