Statamic
CVE-2026-27196
HIGH
GHSA-8r7r-f4gm-wcpq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as user with field management permissions
-
ExploitCreate HTML fieldtype with malicious JavaScript payload
-
ExecutionHigher-privileged user views field
-
ImpactStored XSS executes in victim's browser
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Authenticated user account with field management permissions in Statmatic versions 5.73.8 or below, or 6.0.0-alpha.1 through 6.3.1. Victim must have higher privilege level and view the injected HTML field. |
| Impact | CVSS 8.1 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: High. User interaction: Required. Exploitation requires authentication. |
| Exploit ScenarioDerived | An attacker (requires authentication) could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Versions 5.73.8 and below in addition to 6.0.0-alpha.1 versions up to 6.3.1 is affected by cross-site scripting (xss) (CVSS 8.1).
RemediationAI
Fixed in version 6.3.2. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in composer
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability (CWE-79: Cross-site Scripting (XSS)) affects Versions 5.73.8 and below in addition to 6.0.0-alpha.1. Statmatic is a Laravel and Git powered content management system (CMS). Versions 5.73.8 and below in addition to 6.0.0-alpha.1 through 6.3.1 have a Stored XSS vulnerability in html fieldtypes which allows authenticated users with field management permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. This issue has been fixed in 6.3.2 and 5.73.9.
Know when Statamic gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Statmatic is a Laravel and Git powered content management system (CMS). Versions 5.73.8 and below in addition to 6.0.0-alpha.1 through 6.3.1 have a Stored XSS vulnerability in html fieldtypes which allows authenticated users with field management permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. This issue has been fixed in 6.3.2 and 5.73.9.
Executive ViewAI
A cross-site scripting (XSS) vulnerability affecting multiple versions of a critical application poses a risk of unauthorized access to user sessions and sensitive data theft. Without an available patch, immediate mitigation strategies are essential to prevent potential exploitation and protect customer trust.
Deploy Web Application Firewall (WAF) with XSS detection rules; enforce strict Content Security Policy (CSP) headers; implement input validation and output encoding at the application layer; disable or restrict user-generated content features where feasible; monitor for suspicious activity and injection attempts; isolate affected systems from critical assets; require multi-factor authentication for administrative access; conduct regular security awareness training to reduce social engineering risk vectors.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Affected Products (CPE)GitHub Advisory
Statmic is a core Laravel content management system Composer package. Rated critical severity (CVSS 9.8), this vulnerabi
Statamic is a flat-first, Laravel and Git powered content management system. Rated medium severity (CVSS 5.4), this vuln
Password reset poisoning in Statamic CMS before 6.3.3/5.73.10 allows attackers to steal password reset tokens by manipul
Statamic framework before 2.6.0 does not correctly check a session's permissions when the methods from a user's class ar
Authenticated Statamic CMS users (versions 6.0.0-6.3.x) can bypass privilege escalation verification checks to gain unau
Statamic is a flat-first, Laravel + Git powered CMS designed for building websites. Rated high severity (CVSS 8.8), this
Statamic 2.10.3 allows XSS via First Name or Last Name to the /users URI in an 'Add new user' request. Rated medium seve
Statmatic is a Laravel and Git powered content management system (CMS). [CVSS 8.7 HIGH]
Authenticated users with content creation permissions in Statamic CMS versions 6.0.0 through 6.2.2 can inject persistent
Mass deletion of content, assets, and user accounts in Statamic CMS versions prior to 5.73.20 and 6.13.0 occurs via quer
Stored cross-site scripting in Statamic CMS 5.22.0 and earlier lets an authenticated control-panel user who holds permis
Remote code execution in Statmatic CMS versions prior to 5.73.11 and 6.4.0 allows authenticated users with control panel
Exploit-DB