VulnSocial

CVE-2026-31859General(craftcms / craft_cms)

LOWCVSS 6.1 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch craftcms craft_cms systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Craft is a content management system (CMS). The fix for CVE-2025-35939 in craftcms/cms introduced a strip_tags() call in src/web/User.php to sanitize return URLs before they are stored in the session. However, strip_tags() only removes HTML tags (angle brackets) -- it does not inspect or filter URL schemes. Payloads like javascript:alert(document.cookie) contain no HTML tags and pass through strip_tags() completely unmodified, enabling reflected XSS when the return URL is rendered in an href attribute. This vulnerability is fixed in 5.9.7 and 4.17.3.

craftcms CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Weakness type (CWE)
CWE-79CWE-116

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • craft_cms

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • General: 2 classified signals
  • 2 total mentions across 1 day

Affected systems

Vendors
craftcms
Products
craft_cms

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-03-12: 2Patch / Workaround · 2026-03-12: 1Technical Details · 2026-03-12: 103-12
Signal classification1 categories
General
2100.0%
Referenced assets2 URLs
By indicator
Full discourse2 posts
  • Infoflowcloud@infoflowcloud
    General

    🚨*CVE* CVE-2026-31859 Craft is a content management system (CMS). The fix for CVE-2025-35939 in craftcms/cms introduced a strip_tags() call in src/web/User.php to sanitize return URLs befo… https://www.cve.org/CVERecord?id=CVE-2026-31859 ----- Traducción: CVE-2026-31859 Cra… http://infoflow.cloud`

    Post summary

    The text mentions CVE‑2026‑31859 with minimal context and notes a patch for a different CVE (2025‑35939), but provides no evidence of a PoC, exploit, or active exploitation, and contains only partial technical detail.

    0000096
    57 followersView on X
  • CVE@CVEnew
    General

    CVE-2026-31859 Craft is a content management system (CMS). The fix for CVE-2025-35939 in craftcms/cms introduced a strip_tags() call in src/web/User.php to sanitize return URLs befo… https://www.cve.org/CVERecord?id=CVE-2026-31859

    Post summary

    The note references CVE-2026-31859 in Craft CMS and mentions a strip_tags() call added in a prior fix, but it provides no PoC, exploit, or direct patch details for this CVE.

    00000205
    56.7K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appcraftcmscraft_cms---

Explore more

Back to dashboardcraftcms CVEscraft_cms vulnerabilities