What is the CVSS score of CVE-2026-28426?

CVE-2026-28426 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Laravel are affected by CVE-2026-28426?

A high-severity vulnerability (CVSS 8.7) exists in Statmatic CMS that could allow attackers to compromise systems running this platform.. A patch is available.

How to fix or mitigate CVE-2026-28426?

Within 24 hours: Identify all systems running Statmatic and assess exposure; notify relevant teams. Within 7 days: Apply the available vendor patch to all affected Statmatic instances in development, staging, and production environments. Within 30 days: Conduct post-patch security validation and review access logs for evidence of exploitation.

Laravel CVE-2026-28426

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-02-27 security-advisories@github.com

GHSA-5vrj-wf7v-5wr7

Laravel XSS Statamic

8.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

Patch released

Mar 05, 2026 - 14:32 nvd

Patch available

CVE Published

Feb 27, 2026 - 23:16 nvd

HIGH 8.7

DescriptionGitHub Advisory

Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, stored XSS vulnerability in svg and icon related components allow authenticated users with appropriate permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. This has been fixed in 5.73.11 and 6.4.0.

AnalysisAI

Statmatic is a Laravel and Git powered content management system (CMS). [CVSS 8.7 HIGH]

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate as user with SVG/icon permissions

Delivery

Inject malicious JavaScript in SVG/icon component

Exploit

Crafted payload stored in database

Execution

Higher-privileged user views SVG/icon

Impact

JavaScript executes in user's browser context