CVE-2026-109307 craftcms CVE debrief

Who should care

Defenders responsible for Craft CMS installations, particularly those using version 5.0.0 before 5.10.14, should assess exposure and prioritize verification and updates. This includes operators managing affected deployments, platform administrators, vulnerability management teams, and security teams that need to ensure the integrity of the control panel and data within it.

Why it matters

CVE-2026-109307 is a DOM-based cross-site scripting vulnerability in Craft CMS 5.0.0 before 5.10.14 that could allow attackers to execute JavaScript in the authenticated control panel. Defenders should prioritize verifying and updating to version 5.10.14 or later, and monitoring for suspicious activity in the control panel.

• Potential for attackers to execute JavaScript in the authenticated control panel
• Possible impact on the confidentiality and integrity of data within the control panel
• Need for defenders to verify and update to version 5.10.14 or later
• Potential for attackers to lure victims into opening crafted URLs

Technical summary

The vulnerability exists in the control panel login and 2FA verification flow of Craft CMS 5.0.0 before 5.10.14, where a user-controlled returnUrl accepting javascript: URLs is used in client-side navigation. Attackers can lure a 2FA-enabled victim into opening a crafted /admin/login?verify=1 URL between password submission and TOTP verification, executing JavaScript in the authenticated control panel with the victim's permissions.

Defensive priority

Defenders should prioritize verifying and updating to version 5.10.14 or later, and monitoring for suspicious activity in the control panel.

Recommended defensive actions

• Verify and update to version 5.10.14 or later
• Monitor for suspicious activity in the control panel
• Implement additional security measures to prevent DOM-based XSS attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its existence in Craft CMS 5.0.0 before 5.10.14, and the potential for attackers to execute JavaScript in the authenticated control panel.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.