What is the CVSS score of CVE-2026-28426?

CVE-2026-28426 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Laravel are affected by CVE-2026-28426?

A high-severity vulnerability (CVSS 8.7) exists in Statmatic CMS that could allow attackers to compromise systems running this platform.. A patch is available.

How to fix or mitigate CVE-2026-28426?

Within 24 hours: Identify all systems running Statmatic and assess exposure; notify relevant teams. Within 7 days: Apply the available vendor patch to all affected Statmatic instances in development, staging, and production environments. Within 30 days: Conduct post-patch security validation and review access logs for evidence of exploitation.

Laravel CVE-2026-28426

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-02-27 security-advisories@github.com

GHSA-5vrj-wf7v-5wr7

Laravel XSS Statamic

8.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

Patch released

Mar 05, 2026 - 14:32 nvd

Patch available

CVE Published

Feb 27, 2026 - 23:16 nvd

HIGH 8.7

DescriptionGitHub Advisory

Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, stored XSS vulnerability in svg and icon related components allow authenticated users with appropriate permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. This has been fixed in 5.73.11 and 6.4.0.

AnalysisAI

Statmatic is a Laravel and Git powered content management system (CMS). [CVSS 8.7 HIGH]

Technical ContextAI

Classified as CWE-79 (Cross-site Scripting (XSS)). Affects the svg and icon related component of Statamic. Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, stored XSS vulnerability in svg and icon related components allow authenticated users with appropriate permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. This has been fixed in 5.73.11 and 6.4.0.

RemediationAI

A vendor patch is available — apply it immediately. Fixed in version 5.73.11. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.