GitHub Advisoryadvisory · Packagist

GHSA-ff9r-ww9c-43x8 Statamic CMS vulnerable to privilege escalation via stored cross-site scripting

HIGH Published 2026-02-11 Modified 2026-02-11 Official page ↗
Aliases
CVE-2026-25759
Ecosystem
Packagist
Packages
statamic/cms
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Weaknesses
CWE-79
Reviewed
2026-02-11

Affected packages

• Packagist statamic/cms: >= 6.0.0, < 6.2.3 → fixed in 6.2.3

Description

Impact Stored XSS vulnerability in content titles allow authenticated users with content creation permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. Malicious user must have an account with control panel access and content creation permissions. This vulnerability can be exploited to allow super admin accounts to be created. Patches This has been fixed in 6.2.3.

Related

Alias · CVE (1)

  • CVE-2026-25759 Statmatic is a Laravel and Git powered content management system (CMS). vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References