CVE-2026-25483: 
PHP vulnerability analysis and mitigation

CVE-2026-25483 is a stored Cross-Site Scripting (XSS) vulnerability in Craft Commerce's Order Status History Message feature, with potential for full database exfiltration. It affects Craft Commerce versions 4.0.0-RC1 through 4.10.0 and 5.0.0 through 5.5.1 (the Composer package craftcms/commerce). The vulnerability was disclosed on February 2, 2026, via a GitHub Security Advisory, and published to the NVD on February 3, 2026. It carries a CVSS v3.1 base score of 5.4 (Medium) and a CVSS v4.0 base score of 6.2 (Medium) (Github Advisory, Craft Commerce Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerable sink is located in vendor/craftcms/commerce/src/templates/orders/_history.twig, where the order status history message is rendered via {{ orderHistory.message | md }}. The Twig |md (Markdown) filter processes user-supplied input but does not strip or sanitize raw HTML tags, allowing an attacker with order management permissions to inject malicious <script> tags into the Status Message field. When an admin subsequently views the affected order page, the stored payload executes in their browser context, enabling actions such as triggering the database backup utility and exfiltrating the resulting archive to an attacker-controlled server (Craft Commerce Advisory, Github Advisory).

Successful exploitation can result in full database exfiltration, exposing usernames, emails, password hashes, customer PII (names, addresses, order history), transaction records, coupon codes, GraphQL tokens, 2FA recovery codes, and potentially payment gateway secrets if stored directly in the database. The XSS payload executes in the context of an authenticated admin session, meaning it can also be leveraged for privilege escalation and forced password changes. The database backup utility does not require an elevated session, lowering the bar for automated exfiltration once the XSS fires (Craft Commerce Advisory, Github Advisory).

A detailed proof-of-concept (PoC) is publicly available in the GitHub Security Advisory, including a complete attacker receiver script and step-by-step reproduction instructions. Exploitation requires low privileges (control panel access with order management and database backup utility permissions) and passive user interaction (an admin viewing the compromised order page). The EPSS score is approximately 0.055% (0.018% per GitHub Advisory), indicating low but non-zero probability of near-term exploitation. No CISA KEV listing or confirmed in-the-wild exploitation has been reported at this time (Github Advisory, Craft Commerce Advisory).

1. Obtain required permissions: Gain access to the Craft CMS control panel with permissions to access Craft Commerce, manage/edit orders, and use the database backup utility (these do not require an elevated session).
2. Set up attacker receiver: Deploy a Python HTTP server (as provided in the PoC) on an internet-accessible host to receive the exfiltrated database backup: python3 receiver.py (listening on port 8888 by default).
3. Create or access an order: Navigate to Commerce → Orders in the admin panel, create a new order with a customer email, and mark it as completed.
4. Inject XSS payload: Edit the order, change the order status (which reveals the Status Message field), and enter a crafted XSS payload in the Status Message field that, when executed, calls the Craft CMS database backup endpoint and POSTs the resulting .sql.zip file to ATTACKER:8888.
5. Save the order: Save/update the order to persist the malicious payload in the order status history.
6. Trigger execution: Wait for (or social-engineer) an admin to visit the order page at /admin/commerce/orders/{Order_ID}. The stored XSS fires automatically in the admin's browser.
7. Retrieve exfiltrated data: On the attacker server, collect the timestamped .sql.zip file containing the full database backup, including credentials, PII, and 2FA recovery codes (Craft Commerce Advisory, Github Advisory).

• Network: Unexpected outbound HTTP POST requests from the Craft CMS server or admin browser to an external IP/host on non-standard ports (e.g., 8888); multipart/form-data POST requests containing a db field to an unknown external host.
• Logs: Craft CMS access logs showing requests to the database backup endpoint (/admin/utilities/db-backup or similar) initiated from an admin session shortly after viewing an order page; unusual or repeated access to /admin/commerce/orders/{Order_ID} by admin accounts.
• File System: Unexpected .sql.zip or database dump files created in temporary or web-accessible directories on the server.
• Application: Order status history messages containing raw HTML or <script> tags in the orderHistory.message field of the commerce_orderhistories database table (Craft Commerce Advisory).

Upgrade Craft Commerce to version 4.10.1 (for the v4 branch) or 5.5.2 (for the v5 branch), which patch this and multiple other XSS vulnerabilities. The fix applies HTML escaping to the order status name output (commit 4665a47). As a temporary workaround, the advisory recommends sanitizing the message before rendering by changing the template to {{ orderHistory.message | md | purify }} or escaping HTML prior to Markdown processing with {{ orderHistory.message | e | md }}. Additionally, restricting database backup utility permissions to only highly trusted users reduces the blast radius of exploitation (Craft Commerce Advisory, Release 4.10.1, Release 5.5.2).