Statamic CMS CVE-2025-64112

Requires an authenticated control-panel user who holds permission to create or edit Collections or Taxonomies in Statamic CMS versions ≤ 5.22.0, plus a higher-privileged user (specifically a super admin) who subsequently views the attacker-controlled content in the control panel - the stored payload only fires on that view (UI:R). Exploitation is limited by these two prerequisites (content-creation privilege and admin viewing) and is further enabled by the advisory-noted lack of proper server-side X-CSRF-TOKEN validation, which allows the injected script to perform state-changing account actions. It does not affect default-hardened single-super-admin deployments where no lower-trust editors exist.

This is a genuine but bounded risk. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, base 8.0) requires an authenticated attacker (PR:L) and victim interaction (UI:R), which correctly tempers the raw network vector - this is not a mass-exploitable unauthenticated flaw. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation; this reads as a moderate-priority patch rather than an emergency. The high C/I/A impacts are justified by the vendor advisory (GHSA-g59r-24g3-h7cm), which describes escalation to full superadmin account takeover (password change on ≤5.21.0, email-change-then-reset on 5.22.0). The realistic constraint is the trust model: exploitation needs a malicious-or-compromised content editor AND a super admin who views the poisoned Collection/Taxonomy in the control panel, so the practical risk concentrates in multi-tenant or lower-trust editorial setups. The advisory also cites lack of proper server-side X-CSRF-TOKEN validation as an amplifying factor, which the CWE-79 label alone does not capture.

A control-panel user with content-creation rights sets a Collection or Taxonomy title to a payload containing JavaScript, which the Blade template renders unescaped and Vue then compiles and executes. When a super admin later opens that Collection/Taxonomy in the control panel, the script runs in their session and - abetted by weak CSRF token validation - changes the super admin's password (≤5.21.0) or email to trigger a reset (5.22.0), yielding account takeover. No public exploit code was provided, but the fix commit and detailed advisory make the technique reproducible.