{"answers":{"affected":"2 open source packages ship an affected version, including craftcms/cms.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55793 exists.","fix":"Upgrade craftcms/cms to 5.9.53 or later.","what":"CVE-2026-55793 is a medium-severity cross-site scripting vulnerability in craftcms cms, published on 1 Jul 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2026-55793 and fix it if it is affected.\n\nWhat it is: CVE-2026-55793 is a medium-severity cross-site scripting vulnerability in craftcms cms, published on 1 Jul 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55793 exists.\n\nAffected packages and fixed versions:\n- craftcms/cms (Packagist): affected from 5.0.0-RC1; fixed in 5.9.53\n- craftcms/cms (Packagist): affected from 5.0.0-RC1; fixed in 5.9.53\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-55793/ (Markdown: https://insights.sbomify.com/CVE-2026-55793/index.md)","id":"CVE-2026-55793","markdown":"https://insights.sbomify.com/CVE-2026-55793/index.md","name":"CVE-2026-55793","record":{"aliases":["CLSA-2026-1789415531","GHSA-xrqc-p465-2xvg"],"analysis":{"component_type":"web_application","fix_type":"upgrade","impacts":["account_takeover","code_execution"],"network_reachable":"yes","non_default_config":false,"product_category":"Craft CMS","requires_auth":"low_privilege","summary":"An author can inject JavaScript into entry titles, which executes in admin sessions during drag-and-drop operations in the control panel.","user_interaction":"required","vuln_class":"xss"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":5.9,"severity":"medium","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"description":"Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5.9.22, an author-level control panel user can store a malicious JavaScript payload in an entry title. When an admin, or any control panel user with saveEntries for the same Structure section, drags another entry under the poisoned entry in table view, the payload executes in the victim’s session. The issue is exploitable because the title is escaped into data-title by the server, decoded again by the browser, read with jQuery .data('title'), and then concatenated into a new HTML string without attribute escaping. To exploit, an attacker must have an existing control panel account (Author role minimum), the victim must perform a drag operation (not just visit the page), and the victim’s session needs to be elevated at trigger time. This issue has been fixed in version 5.9.23.","ecosystems":["Packagist"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"Craft CMS: Stored XSS via Structure entry title in table view","id":"CVE-2026-55793","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Packagist","product":null,"products":[],"type":"xss","year":"2026"},"n_packages":2,"n_references":2,"next":{"headline":"Craft CMS: Potential authenticated Remote Code Execution via referrer redirect","id":"CVE-2026-55794"},"packages":[{"ecosystem":"Packagist","fixed":["5.9.53"],"introduced":["5.0.0-RC1"],"last_affected":[],"package":"craftcms/cms","purl":null,"source":"GHSA-xrqc-p465-2xvg"},{"ecosystem":"Packagist","fixed":["5.9.53"],"introduced":["5.0.0-RC1"],"last_affected":[],"package":"craftcms/cms","purl":"pkg:composer/craftcms/cms","source":"GHSA-xrqc-p465-2xvg"}],"prev":{"headline":"Craft CMS: Sensitive File Disclosure / Server-Side File Read","id":"CVE-2026-55792"},"products":["cms"],"published":"2026-07-01","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-07-02","vendors":["craftcms"]},"summary":"An author can inject JavaScript into entry titles, which executes in admin sessions during drag-and-drop operations in the control panel.","url":"https://insights.sbomify.com/CVE-2026-55793/"}