PT-2026-54859

CVE-2026-55790

Published

2026-07-01

Updated

2026-07-06

Description by

CVSS 4.0

7.4

High

MetricsAV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0-RC1 through 5.9.22 Craft CMS versions 4.0.0-RC1 through 4.17.15

Description An attacker with a GitHub account can inject a JavaScript payload into a craftcms/cms issue title. The payload executes within the control panel session of a Craft admin when they use the CraftSupport widget Give feedback screen and enter a search term that retrieves the poisoned issue. This process requires no control panel account or elevated privileges from the attacker.

Recommendations Update to version 5.9.23. Update to version 4.17.16.

Exploitability

Exploit

Fix

Impacts

Researchers

Crypto-Cat

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers