SVG CVE-2026-33172

This vulnerability affects the Statamic CMS content management system, distributed as a Composer package (pkg:composer/statamic_cms). The root cause is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a stored XSS variant. The vulnerability emerges from insufficient sanitization of SVG (Scalable Vector Graphics) files during the reupload process. While SVG is an XML-based vector image format that can embed JavaScript through elements like script tags or event handlers, the CMS failed to properly sanitize these files when they were reuploaded by authenticated users. This represents a classic sanitization bypass where security controls are inconsistently applied across different code paths—initial uploads may have been sanitized, but the reupload functionality lacked equivalent protection, allowing malicious SVG payloads to persist in the asset storage and execute when rendered in victims' browsers.