GitHub Advisoryadvisory · Packagist

GHSA-7rcv-55mj-chg7 Statamic has Stored XSS via SVG Sanitization Bypass

HIGH Published 2026-03-18 Modified 2026-03-25 Official page ↗
Aliases
CVE-2026-33172
Ecosystem
Packagist
Packages
statamic/cms
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Weaknesses
CWE-79
Reviewed
2026-03-18

Affected packages

• Packagist statamic/cms: >= 6.0.0-alpha.1, < 6.7.0 → fixed in 6.7.0 • Packagist statamic/cms: < 5.73.14 → fixed in 5.73.14

Description

Impact Stored XSS vulnerability in SVG asset reuploads allows authenticated users with asset upload permissions to bypass SVG sanitization and inject malicious JavaScript that executes when the asset is viewed. Patches This has been fixed in 5.73.14 and 6.7.0.

Related

Alias · CVE (1)

  • CVE-2026-33172 Statamic is a Laravel and Git powered content management system (CMS). vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References