CVE-2026-25496: Craft has a stored XSS in Number Prefix & Suffix Fields
Summary
A stored XSS vulnerability exists in the Number field type settings. The Prefix and Suffix fields are rendered using the |md|raw Twig filter without proper escaping, allowing script execution when the Number field is displayed on users' profiles.
Proof of Concept
Required Permissions
- Administrator access - allowAdminChanges is enabled in production, which is against our security recommendations.
Steps to Reproduce 1. Log in with an admin account 2. Navigate to Settings → Fields → New field 3. Choose Number as the field type 4. Set the Prefix/Suffix Text field to: <img width="611" height="908" alt="image" src="https://github.com/user-attachments/assets/63766ca4-4fa9-490b-8bea-37364137527d" /> html <img src=x onerror="alert('Number Prefix/Suffix XSS')" hidden> 5. Save the field 6. Add this field to any element (e.g., User Profile fields via Settings → Users → User Fields) 7. Navigate to your account (/admin/myaccount) or any user profile (/admin/users/{id}) 8. XSS executes when viewing the form <img width="1246" height="677" alt="image-1" src="https://github.com/user-attachments/assets/dafeb2b7-905f-4a4b-b3d6-1c16a905498f" />
Mitigation Sanitize prefix/suffix before rendering or use |e filter instead of |raw.
Other sources
Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, a stored XSS vulnerability exists in the Number field type settings. The Prefix and Suffix fields are rendered using the |md|raw Twig filter without proper escaping, allowing script execution when the Number field is displayed on users' profiles. This issue is patched in versions 4.16.18 and 5.8.22.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25496?
CVE-2026-25496 is considered a medium severity vulnerability due to its potential for stored cross-site scripting attacks.
How do I fix CVE-2026-25496?
To fix CVE-2026-25496, update your Craft CMS installation to version 5.8.22 or later.
Which versions are affected by CVE-2026-25496?
CVE-2026-25496 affects Craft CMS versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21.
What types of attacks can CVE-2026-25496 enable?
CVE-2026-25496 can enable stored cross-site scripting attacks, allowing attackers to inject malicious scripts.
Is user interaction required for CVE-2026-25496 to be exploited?
No user interaction is required for CVE-2026-25496 to be exploited, as it allows injection of scripts that can run automatically.