CVE-2026-109307: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in craftcms cms
Description
Craft CMS versions 5.0.0 up to but not including 5.10.14 contain a DOM-based cross-site scripting (XSS) vulnerability in the control panel login and two-factor authentication (2FA) verification flow. This vulnerability arises because a user-controlled returnUrl parameter accepts javascript: URLs, which are used in client-side navigation. An attacker can exploit this by tricking a 2FA-enabled user into opening a crafted URL during the login process, leading to execution of arbitrary JavaScript in the authenticated control panel context.
CVSS v4.0
Score 2.1low
Affected software
craftcms
cms
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-109307 is a DOM-based XSS vulnerability in Craft CMS affecting versions from 5.0.0 to before 5.10.14. The flaw exists in the control panel login and 2FA verification flow where the returnUrl parameter accepts javascript: URLs without proper neutralization. This allows an attacker to craft a URL that, when visited by a 2FA-enabled user between password submission and TOTP verification, executes arbitrary JavaScript with the victim's authenticated control panel permissions.
Potential Impact
Successful exploitation allows execution of arbitrary JavaScript in the context of the authenticated control panel user. This could lead to unauthorized actions performed with the victim's privileges within the CMS control panel. However, the vulnerability requires user interaction and partial authentication (password submitted but 2FA not yet verified). The CVSS score is low (2.1), indicating limited impact and exploitability.
Mitigation Recommendations
The vulnerability affects Craft CMS versions >=5.0.0 and <5.10.14. Users should upgrade to version 5.10.14 or later where this issue is fixed. Since no vendor advisory or patch link is provided, check the official Craft CMS release notes or security advisories to confirm the availability of the fix. Until patched, administrators should be cautious about unsolicited URLs targeting the login and 2FA process.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-12T14:14:27.020Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6acd0c132cdf04f656b11be9
Added to database: 10/12/2026, 16:34:27 UTC
Last enriched: 10/12/2026, 17:19:03 UTC
Last updated: 10/12/2026, 21:46:49 UTC
Views: 14
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.