What is the CVSS score of CVE-2026-27196?

CVE-2026-27196 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Statamic are affected by CVE-2026-27196?

A cross-site scripting (XSS) vulnerability affecting multiple versions of a critical application poses a risk of unauthorized access to user sessions and sensitive data theft.. A patch is available.

How to fix or mitigate CVE-2026-27196?

Within 24 hours: Identify and inventory all systems running affected versions (5.73.8 and below, 6.0.0-alpha.1 through 6.3.1) and restrict external access where possible. Within 7 days: Implement WAF rules to filter malicious XSS payloads, enable Content Security Policy (CSP) headers, and deploy input validation controls. Within 30 days: Contact vendor for patch timeline, evaluate version upgrade options, and conduct security testing on deployed mitigations.

Statamic CVE-2026-27196

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-02-21 security-advisories@github.com

GHSA-8r7r-f4gm-wcpq

XSS Statamic

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 22:04 vuln.today

CVE Published

Feb 21, 2026 - 05:17 nvd

HIGH 8.1

DescriptionGitHub Advisory

Statmatic is a Laravel and Git powered content management system (CMS). Versions 5.73.8 and below in addition to 6.0.0-alpha.1 through 6.3.1 have a Stored XSS vulnerability in html fieldtypes which allows authenticated users with field management permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. This issue has been fixed in 6.3.2 and 5.73.9.

AnalysisAI

Versions 5.73.8 and below in addition to 6.0.0-alpha.1 versions up to 6.3.1 is affected by cross-site scripting (xss) (CVSS 8.1).

Technical ContextAI

This vulnerability (CWE-79: Cross-site Scripting (XSS)) affects Versions 5.73.8 and below in addition to 6.0.0-alpha.1. Statmatic is a Laravel and Git powered content management system (CMS). Versions 5.73.8 and below in addition to 6.0.0-alpha.1 through 6.3.1 have a Stored XSS vulnerability in html fieldtypes which allows authenticated users with field management permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. This issue has been fixed in 6.3.2 and 5.73.9.

RemediationAI

Fixed in version 6.3.2. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.