XSS in Craftcms Cms

CVE-2026-55791

Craft CMS is a content management system (CMS). Versions 4.0.0-RC1 and above, prior to 4.18.0 and 5.0.0-RC1, and above, prior to 5.10.0, are vulnerable to Server-Side Request Forgery (SSRF) and Arbitrary JavaScript Injection through the /a…

Vulnerability class: XSS (Cross-Site Scripting)

Affected products

  • Craftcms Cms — versions >= 5.0.0-RC1, < 5.10.0, >= 4.0.0-RC1, < 4.18.0

Weakness classification (CWE)

References