要点
- CVE-2026-25496 は craftcms/cms, craft cms (craftcms) に影響する深刻度「中」 (CVSS 4.8) の脆弱性です。
- 今後30日間に悪用される確率（EPSS）：0.42%（全脆弱性の 35.9% より高い）。
- 対処：4.16.18, 5.8.22 以降に更新してください。
| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|
| craftcms/cms Packagist | ≥ 4.0.0-RC1, < 4.16.18≥ 5.0.0-RC1, < 5.8.22
| 4.16.185.8.22
|
| craft cms | = 4.0.0= 5.0.0> 4.0.0, < 4.16.18> 5.0.0, < 5.8.22
| 4.16.185.8.22
|
概要
Summary
A stored XSS vulnerability exists in the Number field type settings. The Prefix and Suffix fields are rendered using the |md|raw Twig filter without proper escaping, allowing script execution when the Number field is displayed on users' profiles.
Proof of Concept
Required Permissions
Steps to Reproduce
- Log in with an admin account
- Navigate to Settings → Fields → New field
- Choose Number as the field type
- Set the Prefix/Suffix Text field to: <img width="611" height="908" alt="image" src="https://github.com/user-attachments/assets/63766ca4-4fa9-490b-8bea-37364137527d" />
<img src=x onerror="alert('Number Prefix/Suffix XSS')" hidden>
- Save the field
- Add this field to any element (e.g., User Profile fields via Settings → Users → User Fields)
- Navigate to your account (
/admin/myaccount) or any user profile (/admin/users/{id})
- XSS executes when viewing the form <img width="1246" height="677" alt="image-1" src="https://github.com/user-attachments/assets/dafeb2b7-905f-4a4b-b3d6-1c16a905498f" />
Mitigation
Sanitize prefix/suffix before rendering or use |e filter instead of |raw.
NVD の説明
Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, a stored XSS vulnerability exists in the Number field type settings. The Prefix and Suffix fields are rendered using the |md|raw Twig filter without proper escaping, allowing script execution when the Number field is displayed on users' profiles. This issue is patched in versions 4.16.18 and 5.8.22.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン