CVE-2026-25496 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, a stored XSS vulnerability exist…
Medium CVSS: 4.8

CVE-2026-25496

Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, a stored XSS vulnerability exists in the Number field type settings. The Prefix and Suffix fields are rendered using the |md|raw Twig filter without proper escaping, allowing script execution when the Number field is displayed on users' profiles. This issue is patched in versions 4.16.18 and 5.8.22.
Vendor
Craftcms
Product
Craft Cms
CWE
CWE-79
Yayın Tarihi
2026-02-09 20:15:58
Güncelleme
2026-02-19 19:17:02
Source Identifier
security-advisories@github.com
KEV Date Added
-

Kategoriler

CWE-79 Craft Cms MEDIUM Craftcms 2026

Referanslar

https://github.com/craftcms/cms/commit/cb5fb0e979e72f315c9178fc031883d49527f513 https://github.com/craftcms/cms/releases/tag/5.8.22 https://github.com/craftcms/cms/security/advisories/GHSA-9f5h-mmq6-2x78