CVE-2026-25491: Craft has a Stored XSS in Entry Types Name
Summary
Stored XSS via Entry Type names. The name is not sanitized when displayed in the Entry Types list.
--- Proof of Concept
Required Permissions (Attacker)
- Admin access (only admins have access to the settings page) - allowAdminChanges is enabled in production, which is against our security recommendations.
Steps to Reproduce 1. Log in as an attacker. 2. Go to Settings -> Entry Types (/admin/settings/entry-types). 3. Create a new Entry Type. 4. Set Name to: html <img src=x onerror="alert('XSS-EntryTypes')" hidden> 5. Save the Entry Type, and you’ll be redirected back to the entry types table automatically. 6. Notice the alert fires when the entry types table renders.
Other sources
Craft is a platform for creating digital experiences. From 5.0.0-RC1 to 5.8.21, Craft has a stored XSS via Entry Type names. The name is not sanitized when displayed in the Entry Types list. This vulnerability is fixed in 5.8.22.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25491?
CVE-2026-25491 has a high severity due to its nature as a Stored XSS vulnerability.
How do I fix CVE-2026-25491?
To fix CVE-2026-25491, upgrade Craft to version 5.8.22 or later.
What versions of Craft are affected by CVE-2026-25491?
Craft versions from 5.0.0-RC1 to 5.8.21 are affected by CVE-2026-25491.
What type of vulnerability is CVE-2026-25491?
CVE-2026-25491 is categorized as a Stored Cross-Site Scripting (XSS) vulnerability.
How does CVE-2026-25491 impact users?
CVE-2026-25491 allows attackers to execute malicious scripts in the context of authenticated users through unvalidated Entry Type names.