CVE-2026-72787: 
Craft CMS vulnerability analysis and mitigation

CVE-2026-72787 is a stored cross-site scripting (XSS) vulnerability in Craft CMS affecting all versions from 5.0.0-RC1 up to (but not including) 5.10.8. The flaw exists in the control panel's element chip/card rendering logic, where draft names are written to the page without HTML encoding, allowing a low-privilege user to inject persistent JavaScript payloads. It was published on August 12, 2026, with a patch released in version 5.10.8. The vulnerability carries a CVSS v3.1 score of 6.4 (Medium) and a CVSS v4.0 score of 5.1 (Medium) (GitHub Advisory, Craft CMS Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a missing HTML-encoding step in the control-panel helper that renders element chip and card labels. While surrounding path segments are properly encoded, the draftName field is written directly into the page DOM without sanitization. An attacker with a low-privilege control-panel account who has permission to create element drafts (e.g., entries) can set a draft name containing a malicious JavaScript payload; this payload is then executed in the browser of any higher-privileged user (including administrators) who views the affected element's chip or card during routine control-panel activity such as browsing element indexes or relation fields. The advisory notes this is the same output-encoding class of bug as previously fixed issues GHSA-xrqc-p465-2xvg and GHSA-3x4w-mxpf-fhqq (Craft CMS Advisory).

Successful exploitation allows a low-privilege attacker to execute arbitrary JavaScript within the authenticated session of a higher-privileged control-panel user, including administrators. Because the script runs in the control-panel origin, it can access the CSRF token embedded in the page (Craft.csrfTokenValue) and issue authenticated actions on behalf of the victim — this was verified end-to-end to create new user accounts via the users/save-user action, an admin-only capability. The attack scope extends to any action available to the victim's session, enabling privilege escalation, account takeover, and unauthorized administrative operations (Craft CMS Advisory, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time, per NVD SSVC assessment and Feedly threat intelligence (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.19% (9th percentile), indicating a low near-term exploitation probability. Exploitation is not fully automated (NVD SSVC: automatable = no), as it requires a victim administrator to organically browse the affected element's chip or card in the control panel.

1. Obtain a low-privilege account: Acquire or register a Craft CMS control-panel account with at least entry-editing permissions in one section and the ability to create drafts.
2. Create a malicious draft: Navigate to an entry or other element in the control panel and create a new draft. Set the draft name to a JavaScript payload, e.g., <img src=x onerror="fetch('/actions/users/save-user',{method:'POST',headers:{'X-CSRF-Token':Craft.csrfTokenValue},body:new URLSearchParams({username:'attacker',email:'attacker@evil.com',password:'P@ssw0rd!'})})">.
3. Save the draft: Submit the draft, persisting the unencoded payload in the database as the draft's name.
4. Wait for victim interaction: The payload fires automatically when any higher-privileged user (e.g., an administrator) views the element's chip or card during routine control-panel activity — such as browsing element indexes, relation fields, or the drafts list — without any additional attacker interaction.
5. Harvest CSRF token and execute actions: The injected script reads Craft.csrfTokenValue from the victim's page context and uses it to issue authenticated control-panel requests (e.g., creating a new admin account) on behalf of the victim (Craft CMS Advisory).

• Logs: Craft CMS application logs showing users/save-user or other admin-only action requests originating from unexpected sessions or IP addresses; audit log entries for new account creation not initiated by an administrator.
• Database/Content: Draft records in the CMS database with names containing HTML tags, JavaScript event handlers (e.g., onerror, onload), or <script> tags.
• Network: Outbound HTTP requests from the control-panel origin to external domains initiated by administrator browser sessions; unexpected POST requests to /actions/users/save-user or similar endpoints during administrator browsing sessions.
• User Accounts: Newly created control-panel user accounts not provisioned through normal administrative workflows, particularly those created around the time an administrator viewed a draft-containing element (Craft CMS Advisory).

The primary remediation is to upgrade Craft CMS to version 5.10.8 or later, which applies proper HTML encoding to draft names in element chip/card rendering (Craft CMS Advisory, GitHub Advisory). As interim mitigations, restrict the ability to create element drafts to only fully trusted users, and implement a strict Content Security Policy (CSP) header on the control panel to limit the impact of any stored XSS. Administrators should also review audit logs for unauthorized account creation and monitor draft names for suspicious content.

The vulnerability was reported by researcher je-lv and published by Craft CMS maintainer angrybrad via GitHub Security Advisories on July 25, 2026, with the CVE assigned on August 12, 2026 (Craft CMS Advisory). The advisory explicitly notes this is part of a pattern of output-encoding omissions in the Craft CMS control panel, referencing two prior related fixes (GHSA-xrqc-p465-2xvg and GHSA-3x4w-mxpf-fhqq), suggesting ongoing scrutiny of the CMS's rendering pipeline. No significant broader media coverage or notable social media discussion has been identified at this time.