{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "craftcms/cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0-RC1"
            },
            {
              "fixed": "5.10.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-06T21:33:15Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "The control-panel helper that renders element chip/card labels writes an element\u0027s `draftName` into the page without HTML-encoding it, while the surrounding path segments are encoded.\n\nA low-privilege control-panel user who can create a draft of an element (for example, an entry) controls the draft name, so they can store an XSS payload that executes in the browser of any other control-panel user who is shown that element\u2019s chip or card (element indexes with drafts visible, relation and element-selection fields that reference the element, and the drafts list).\n\nThis allows a low-privilege author to run JavaScript in an administrator\u2019s authenticated session and take over the control panel. It is the same output-encoding class as the recently fixed GHSA-xrqc-p465-2xvg (Structure entry title) and GHSA-3x4w-mxpf-fhqq (revision context menu), which encoded other user-controlled titles but not the draft name.\n\n### Prerequisites\n\n- A control-panel account with permission to edit entries in at least one section and create drafts.\n- A higher-privileged user (for example, an administrator) who is later shown the draft\u2019s chip or card (an element index with drafts visible, or a relation/element-selection field referencing the element).\n\n### Limitations\n\n- Requires the victim to be shown the affected element\u0027s chip/card in the control panel (normal day-to-day activity; element indexes and relation fields are routine).\n- The payload runs in the control-panel origin in the victim\u2019s session.\n\n## Impact\n\nA low-privilege author can run arbitrary JavaScript in the session of any higher-privileged control-panel user who is shown the element\u2019s chip or card, including administrators. This is a cross-privilege stored XSS, not a self-XSS: the attacker and the victim are different users, and the payload fires during routine browsing of element indexes and relation fields.\n\nBecause the script runs in the victim\u2019s control-panel origin, it can read the CSRF token that Craft embeds in the page JavaScript (`Craft.csrfTokenValue`, confirmed present on control-panel pages) and issue authenticated control-panel actions as the victim. This was verified end-to-end on Craft Pro: an in-session request to the `users/save-user` action created a brand new account (`User saved.`, HTTP 200), an admin-only capability that an author can never perform directly.",
  "id": "GHSA-2rp4-x2j7-qmcc",
  "modified": "2026-08-06T21:33:15Z",
  "published": "2026-08-06T21:33:15Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms/security/advisories/GHSA-2rp4-x2j7-qmcc"
    },
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms/commit/06c799148537ce960f6bc86e162b499947040eda"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/craftcms/cms"
    },
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms/releases/tag/5.10.8"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Craft CMS: Stored XSS in the control panel via unescaped draft name"
}