What’s Vulnerable › Vulnerabilities

CVE-2026-28426: Statamic vulnerable to privilege escalation via stored cross-site scripting

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-27 · updated 2026-06-17
• Weakness: CWE-79

Description

Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, stored XSS vulnerability in svg and icon related components allow authenticated users with appropriate permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. This has been fixed in 5.73.11 and 6.4.0.

Affected products

• Statamic: before 5.73.11; from 6.0.0 before 6.4.0 — fixed in 5.73.11, 6.4.0

How to fix

Upgrade to a fixed version: Statamic 5.73.11, 6.4.0. Check the vendor advisory for mitigations.

References

• https://github.com/statamic/cms/releases/tag/v5.73.11
• https://github.com/statamic/cms/releases/tag/v6.4.0
• https://github.com/statamic/cms/security/advisories/GHSA-5vrj-wf7v-5wr7

Get alerted when CVE-2026-28426 or the next vulnerability affects your stack