CVE-2026-33051

MEDIUM

5.4

Descricao

Craft CMS is a content management system (CMS). In versions 5.9.0-beta.1 through 5.9.10, the revision/draft context menu in the element editor renders the creator’s fullName as raw HTML due to the use of Template::raw() combined with Craft::t() string interpolation. A low-privileged control panel user (e.g., Author) can set their fullName to an XSS payload via the profile editor, then create an entry with two saves. If an administrator is logged in and executes a specifically crafted payload while an elevated session is active, the attacker’s account can be elevated to administrator. This issue has been fixed in version 5.9.11.

Detalhes CVE

Pontuacao CVSS v3.15.4

SeveridadeMEDIUM

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosLOW

Interacao do usuarioREQUIRED

Publicado3/20/2026

Ultima modificacao3/20/2026

Fontenvd

Avistamentos honeypot0

Produtos afetados

craftcms:craft_cms

Fraquezas (CWE)

CWE-79

Referencias

https://github.com/craftcms/cms/commit/f634a9d21edcafd83a6716047d275f985aba6be1(security-advisories@github.com)

https://github.com/craftcms/cms/releases/tag/5.9.11(security-advisories@github.com)

https://github.com/craftcms/cms/security/advisories/GHSA-3x4w-mxpf-fhqq(security-advisories@github.com)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.