CVE-2026-27196CWE-79

Statamic affected by privilege escalation via stored Cross-site Scripting

High · published February 21, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
34.8
In the wild
Unconfirmed
What it is

Statmatic is a Laravel and Git powered content management system (CMS). Versions 5.73.8 and below in addition to 6.0.0-alpha.1 through 6.3.1 have a Stored XSS vulnerability in html fieldtypes which allows authenticated users with field management permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. This issue has been fixed in 6.3.2 and 5.73.9.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00415 · 34.8th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-02-21T04:30Z
EPSS history
Timeline
  • 21 FEB 04:30Z
    Statamic affected by privilege escalation via stored Cross-site Scripting
    cvelistv5