CVE-2026-31859 | Craft CMS Return URL setReturnUrl cross site scripting

A vulnerability classified as problematic was found in Craft CMS. Affected by this vulnerability is the function setReturnUrl of the component Return URL Handler. Executing a manipulation can lead to cross site scripting.

This vulnerability is registered as CVE-2026-31859. It is possible to launch the attack remotely. No exploit is available.

Upgrading the affected component is advised.