SVG CVE-2026-33172
HIGH
GHSA-7rcv-55mj-chg7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticated user uploads malicious SVG asset
-
DeliveryBypass SVG sanitization during reupload
-
ExploitInject malicious JavaScript payload
-
ExecutionVictim views asset
-
ImpactExecute XSS in browser context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires authenticated user account with asset upload permissions. Attacker uploads malicious SVG file exploiting sanitization bypass in asset reupload functionality. Victim must view the uploaded SVG asset in affected versions (before 5.73.14 or 6.7.0). Stored XSS executes in victim's browser with high impact. |
| Impact | The real-world risk is moderate despite the high CVSS score of 8.7. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) indicates network-based attacks with low complexity, but exploitation requires authenticated access with asset upload permissions (PR:L) and victim user interaction (UI:R). The changed scope (S:C) reflects that malicious JavaScript executes in victims' browser contexts, potentially affecting resources beyond the vulnerable component. No EPSS score or KEV (Known Exploited Vulnerabilities) status is provided in the intelligence data, suggesting this is not currently being actively exploited in the wild. The attack requires insider access or compromised low-privileged credentials, limiting the threat actor pool primarily to malicious authenticated users or attackers who have already gained initial access. From an SSVC perspective, exploitation is not automatable due to the authentication and user interaction requirements, though technical impact is high given the potential for session hijacking and data exfiltration. This is a priority for organizations using Statamic CMS with multiple content editors, but lower priority than unauthenticated or wormable vulnerabilities. |
| Exploit ScenarioDerived | An authenticated attacker with asset upload permissions logs into the Statamic CMS and uploads a crafted SVG file containing embedded JavaScript within script tags or event handlers. When another user, particularly an administrator, views the asset through the CMS interface or on the public-facing website, the malicious JavaScript executes in their browser context, allowing the attacker to steal session cookies, perform actions on behalf of the victim, or exfiltrate sensitive data accessible to that user's privilege level. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 18, 2026
A stored cross-site scripting (XSS) vulnerability in Statamic CMS allows authenticated users with asset upload permissions to bypass SVG sanitization during asset reuploads, enabling injection of malicious JavaScript that executes when other users view the compromised asset. The vulnerability affects Statamic CMS versions prior to 5.73.14 and 6.7.0, with patches available in those releases. The CVSS score of 8.7 (High) reflects the changed scope and high confidentiality/integrity impact, though exploitation requires low-privileged authenticated access and user interaction.
RemediationAI
Upgrade Statamic CMS to version 5.73.14 or later if using the 5.x branch, or to version 6.7.0 or later if using the 6.x branch, as documented in the GitHub Security Advisory at https://github.com/statamic/cms/security/advisories/GHSA-7rcv-55mj-chg7. Until patching is possible, implement compensating controls such as restricting asset upload permissions to only highly trusted users, implementing Content Security Policy (CSP) headers to prevent inline script execution, and conducting security reviews of recently uploaded SVG assets for malicious content. Organizations should also monitor for suspicious SVG uploads and audit user accounts with asset upload permissions to ensure no unauthorized access exists.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in composer
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability affects the Statamic CMS content management system, distributed as a Composer package (pkg:composer/statamic_cms). The root cause is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a stored XSS variant. The vulnerability emerges from insufficient sanitization of SVG (Scalable Vector Graphics) files during the reupload process. While SVG is an XML-based vector image format that can embed JavaScript through elements like script tags or event handlers, the CMS failed to properly sanitize these files when they were reuploaded by authenticated users. This represents a classic sanitization bypass where security controls are inconsistently applied across different code paths—initial uploads may have been sanitized, but the reupload functionality lacked equivalent protection, allowing malicious SVG payloads to persist in the asset storage and execute when rendered in victims' browsers.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Impact
Stored XSS vulnerability in SVG asset reuploads allows authenticated users with asset upload permissions to bypass SVG sanitization and inject malicious JavaScript that executes when the asset is viewed.
Patches
This has been fixed in 5.73.14 and 6.7.0.
Executive ViewAI
A stored cross-site scripting vulnerability in Statamic CMS allows authenticated users to inject malicious code through asset uploads, potentially compromising other users who access those assets. This affects organizations running vulnerable versions of Statamic CMS and could lead to unauthorized access, data theft, or credential compromise of affected users.
Until patched: (1) Disable SVG asset uploads entirely or restrict to administrators only; (2) Implement Web Application Firewall (WAF) rules to detect and block suspicious SVG content patterns; (3) Require manual security review of all SVG assets before publication; (4) Segment asset storage from production systems; (5) Implement Content Security Policy (CSP) headers to restrict inline script execution; (6) Monitor asset access logs for suspicious viewing patterns.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB