Security readout for executives and security teams
Plain-English summary
Craft CMS before 3.6.0 had a potential cross-site scripting issue tied to some front-end forms that accepted user uploads. The public record does not show active exploitation or a CVSS score. The main concern is user-supplied upload content causing script execution in another user's browser under specific site conditions.
Executive priority
Prioritize remediation for internet-facing Craft CMS sites with public upload forms. Without evidence of active exploitation or a severity score, this is not automatically critical, but XSS can affect user trust, admin sessions, and content integrity.
Technical view
CVE-2021-27902 is described as a potential XSS vulnerability in Craft CMS before 3.6.0 involving front-end forms that accept user uploads. The provided sources do not include CWE, CVSS, proof-of-concept detail, or exploit telemetry. The referenced Craft CMS changelog and commit are the primary remediation evidence.
Likely exposure
Exposure is most likely on Craft CMS sites running versions before 3.6.0 that expose front-end upload forms. Sites without user-facing upload workflows are less likely to be affected, but version and form behavior should be verified.
Exploitation context
The source bundle does not identify exploitation in the wild, and the CVE is not listed as KEV. Treat this as a plausible stored or reflected XSS risk where uploaded user content is later rendered to users or administrators.
Researcher notes
Public evidence is sparse. The CVE text gives the affected version boundary and vulnerability class, but not the exact trigger conditions. Avoid assuming exploitability on every Craft CMS site; validate version, upload exposure, and rendering paths.
Mitigation direction
- Upgrade Craft CMS to version 3.6.0 or later.
- Review Craft CMS vendor guidance and changelog for related security notes.
- Audit front-end forms that accept uploads from untrusted users.
- Restrict upload types and rendering behavior according to site requirements.
- Monitor application logs for suspicious upload and rendering activity.
Validation and detection
- Identify all Craft CMS instances and record installed versions.
- Confirm whether any instance runs a version before 3.6.0.
- Inventory public front-end forms that accept file uploads.
- Verify upgraded instances no longer use affected Craft CMS versions.
- Review recent upload activity for unusual file names or content patterns.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-27902 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#security-1CVE reference · x_refsource_MISC
- https://github.com/craftcms/cms/commit/8ee85a8f03c143fa2420e7d6f311d95cae3b19ceCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.