CVE-2026-31859: 
PHP vulnerability analysis and mitigation

CVE-2026-31859 is a reflected Cross-Site Scripting (XSS) vulnerability in Craft CMS caused by incomplete return URL sanitization. It was introduced as a regression in the fix for CVE-2025-35939, where a strip_tags() call was added to sanitize return URLs but failed to filter dangerous URL schemes such as javascript:. Affected versions are Craft CMS 4.15.3–4.17.2 and 5.7.5–5.9.6; patched versions are 4.17.3 and 5.9.7. The vulnerability was disclosed on March 9, 2026, and carries a CVSS v3.1 score of 6.1 (Medium) and a CVSS v4.0 score of 6.9 (Medium) (Github Advisory, Craft CMS Advisory).

The root cause is an incomplete sanitization implementation in src/web/User.php (CWE-79, CWE-116). The setReturnUrl() method applies PHP's strip_tags() to user-supplied return URLs before storing them in the session, but strip_tags() only strips HTML angle-bracket tags — it does not validate or filter URL schemes. As a result, payloads such as javascript:alert(document.cookie), data:text/html;base64,..., and protocol-relative URLs like //evil.com/steal pass through the sanitizer completely unmodified. When the stored URL is later rendered in an href attribute (e.g., a "Return" or "Continue" link), clicking it executes the attacker-controlled payload in the victim's browser context (Craft CMS Advisory, Github Advisory).

Successful exploitation enables reflected XSS in the context of the Craft CMS origin, allowing an attacker to steal session cookies (document.cookie), exfiltrate data via fetch() to an attacker-controlled server, perform CSRF actions on behalf of the authenticated user, or redirect victims to phishing domains via protocol-relative URLs. The vulnerability requires no authentication and no special privileges from the attacker, though it does require user interaction (the victim must click a crafted link). Availability is not directly impacted, but confidentiality and integrity of the victim's session and data are at risk (Github Advisory).

No public exploit code or active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.041% (13th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires social engineering to deliver a crafted link to a victim, making mass exploitation less likely but targeted attacks feasible (Github Advisory).

1. Reconnaissance: Identify Craft CMS instances running versions 4.15.3–4.17.2 or 5.7.5–5.9.6 using web fingerprinting tools (e.g., Wappalyzer, Shodan) or by inspecting HTTP response headers and page source for Craft CMS indicators.
2. Craft malicious URL: Construct a URL targeting the vulnerable returnUrl parameter, such as https://target.example.com/craft/?returnUrl=javascript:alert(document.cookie) or using a data: URI payload like https://target.example.com/craft/?returnUrl=data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==.
3. Deliver the link: Send the crafted URL to a target victim via phishing email, social media, or other social engineering channels.
4. Victim interaction: The victim clicks the link, causing the Craft CMS application to call setReturnUrl() with the attacker-controlled value; strip_tags() passes the payload unchanged and stores it in the session.
5. Payload execution: The stored URL is rendered in an href attribute on a subsequent page (e.g., a "Return" or "Continue" link); when the victim clicks it, the javascript: payload executes in the browser, enabling cookie theft, data exfiltration, or CSRF actions (Craft CMS Advisory).

• Network: HTTP requests to Craft CMS endpoints containing returnUrl parameter values with javascript:, data:, or // (protocol-relative) schemes; outbound connections from victim browsers to unexpected external domains following Craft CMS page visits.
• Logs: Web server access logs showing GET requests with returnUrl=javascript: or returnUrl=data: query parameters; session logs storing non-HTTP/HTTPS return URL values.
• Application: Craft CMS session data containing return URLs with schemes other than http or https, indicating the vulnerable code path was triggered before patching.

Upgrade Craft CMS to version 4.17.3 (for the 4.x branch) or 5.9.7 (for the 5.x branch), which implement proper URL scheme validation in setReturnUrl() by using parse_url() to extract and allowlist only http and https schemes, replacing any disallowed scheme with / before passing to strip_tags(). No configuration-based workaround is available; upgrading is the only remediation. Organizations unable to upgrade immediately should consider deploying a WAF rule to block requests containing returnUrl values with javascript:, data:, or // prefixes (Craft CMS Advisory, Patch Commit).

The vulnerability was reported by researcher zly123987 and published by the Craft CMS maintainer angrybrad on March 9, 2026. The advisory notes this is a regression introduced by the prior fix for CVE-2025-35939, highlighting the risk of using semantically inappropriate sanitization functions (strip_tags() for URL validation). The issue received standard community attention via CVE tracking feeds and vulnerability databases, with no notable controversy or widespread media coverage (Craft CMS Advisory).