{"id":"CVE-2026-31859","published":"2026-03-11T17:37:19Z","modified":"2026-03-12T14:00:23Z","title":"Craft has Reflective XSS via incomplete return URL sanitization","vendor":"Craft CMS","product":"cms","tier":"tail","description":{"text":"Craft is a content management system (CMS). The fix for CVE-2025-35939 in craftcms/cms introduced a strip_tags() call in src/web/User.php to sanitize return URLs before they are stored in the session. However, strip_tags() only removes HTML tags (angle brackets) -- it does not inspect or filter URL schemes. Payloads like javascript:alert(document.cookie) contain no HTML tags and pass through strip_tags() completely unmodified, enabling reflected XSS when the return URL is rendered in an href attribute. This vulnerability is fixed in  5.9.7 and 4.17.3.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.9,"severity":"MEDIUM","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00192,"percentile":0.08866,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"},{"id":"CWE-116","name":"Improper Encoding or Escaping of Output"}],"references":[{"url":"https://github.com/craftcms/cms/security/advisories/GHSA-fvwq-45qv-xvhv","tags":["x_refsource_CONFIRM"]}],"priority":{"score":6.6,"factors":[{"name":"EPSS percentile","points":1.77},{"name":"CVSS severity","points":4.83}]},"vendorSlug":"craft-cms","affectedVersions":[{"vendor":"craftcms","product":"cms","versions":[">= 4.15.3, < 4.17.3",">= 5.7.5, < 5.9.7"]}],"affected":[{"ecosystem":"Packagist","package":"craftcms/cms","vulnerableRanges":[">=4.15.3, <4.17.3",">=5.7.5, <5.9.7"],"patched":["4.17.3","5.9.7"],"from":["GHSA-fvwq-45qv-xvhv"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-11261","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-craft-cms-cve-2025-35939","parents":[{"from":"CVE-2025-35939","to":"CVE-2026-31859","relation":"regression","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"regression","quote":"The fix for CVE-2025-35939 in craftcms/cms introduced a strip_tags() call in src/web/User.php to sanitize return URLs before they are stored in the session.","from":"CVE.org","in":"CVE-2026-31859"}]}],"packageHistory":[{"cve":"CVE-2026-56393","published":"2026-06-21","fixed":"5.9.0-beta.1","kev":false},{"cve":"CVE-2026-29069","published":"2026-03-04","fixed":"5.9.0-beta.2","kev":false,"link":{"from":"CVE-2026-29069","to":"CVE-2026-31859","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:craftcms/cms","fromFixed":"4.17.0-beta.2","toFixed":"4.17.3","daysApart":7},{"kind":"version-step","provenance":"source","package":"Packagist:craftcms/cms","fromFixed":"5.9.0-beta.2","toFixed":"5.9.7","daysApart":7}]}},{"cve":"CVE-2026-29113","published":"2026-03-10","fixed":"5.9.7","kev":false},{"cve":"CVE-2026-31859","published":"2026-03-11","fixed":"5.9.7","kev":false},{"cve":"CVE-2026-31857","published":"2026-03-11","fixed":"5.9.9","kev":false,"link":{"from":"CVE-2026-31859","to":"CVE-2026-31857","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:craftcms/cms","fromFixed":"4.17.3","toFixed":"4.17.4","daysApart":0},{"kind":"version-step","provenance":"source","package":"Packagist:craftcms/cms","fromFixed":"5.9.7","toFixed":"5.9.9","daysApart":0}]}},{"cve":"CVE-2026-31858","published":"2026-03-11","fixed":"5.9.9","kev":false,"link":{"from":"CVE-2026-31859","to":"CVE-2026-31858","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:craftcms/cms","fromFixed":"5.9.7","toFixed":"5.9.9","daysApart":0}]}},{"cve":"CVE-2026-32262","published":"2026-03-16","fixed":"5.9.11","kev":false}],"package":"Packagist:craftcms/cms"}}