MediumGHSA-6qjx-787v-6pxrCVE-2023-33197

Craft CMS stored XSS in indexedVolumes

Published 26 May 2023 · Updated 10 Sept 2026

Affected package

craftcms/cmsComposer
Affected
>=4.0.0-RC1 <4.4.6
Fixed in
4.4.6
Update to the fixed version for your release line, for example:composer require craftcms/cms:^4.4.6

Details

Summary

XSS can be triggered via the Update Asset Index utility

PoC

1. Access setting tab 2. Create new assets 3. In assets name inject payload: "<script>alert(26)</script> 4. Click Utilities tab 5. Choose all volumes, or volume trigger xss 7. Click Update asset indexes.

XSS will be triggered

Json response volumes name makes triggers the payload

"session":{"id":1,"indexedVolumes":{"1":"\"<script>alert(26)</script>"},

It’s run on every POST request in the utility.

Resolved in https://github.com/craftcms/cms/commit/8c2ad0bd313015b8ee42326af2848ee748f1d766

Is GHSA-6qjx-787v-6pxr in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected craftcms/cms, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.