CVE-2026-56381

描述

## Summary A stored XSS vulnerability exists in the User Permissions page. The User Group name is rendered without proper HTML escaping in the permissions section, allowing an attacker to execute arbitrary JavaScript when another user views or edits a user's permissions. > [!NOTE] > This is a separate vulnerability from the previously reported "[Stored XSS via User Group Name in User Settings Page](https://github.com/craftcms/cms/security/advisories/GHSA-2423-8xxj-wc3g)" and "[Multiple Stored XSS in User Group Edit Page](https://github.com/craftcms/cms/security/advisories/GHSA-vx7g-xw92-g4xj)". This affects a different sink: the individual user's permissions page. ## Proof of Concept ### Required Permissions - Admin access - `allowAdminChanges` is enabled in production, which is against our [security recommendations](https://craftcms.com/knowledge-base/securing-craft). ### Steps to Reproduce 1. Log in to the control panel as an admin 2. Navigate to **Settings → Users → User Groups** 3. Create or edit a user group and set the **Name** field to: ```html <img src=x onerror="alert('XSS')" hidden> ``` 4. Save the user group 5. Navigate to **Users** and edit any user (`/admin/users/{id}`) 6. Click on the **Permissions** tab 7. XSS executes ## Mitigation Sanitize user group names when rendering in the user permissions template. ## References https://github.com/craftcms/cms-ghsa-4mgv-366x-qxvx/pull/2

如何修補 CVE-2026-56381

要修補 CVE-2026-56381,請將受影響套件升級到下列已修補版本。

• —升級至 5.8.22 或更新版本

CVE-2026-56381 正在被利用嗎?

低 — EPSS 為 0.1%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• >= 5.0.0-RC1, < 5.8.22

CVSS 分數

參考連結(3)

• PATCHgithub.com/craftcms/cms
• WEBgithub.com/craftcms/cms/releases/tag/5.8.22
• WEBgithub.com/craftcms/cms/security/advisories/GHSA-g3hp-vvqf-8vw6