p PatchFirst

CVE-2026-25759

CVE-2026-25759 · Statmatic affected by privilege escalation via stored cross-site scripting

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Statmatic is a Laravel and Git powered content management system (CMS). From 6.0.0 to before 6.2.3, a stored XSS vulnerability in content titles allows authenticated users with content creation permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. Malicious user must have an account with control panel access and content creation permissions. This vulnerability can be exploited to allow super admin accounts to be created. This has been fixed in 6.2.3.

CVSS 8.7 · High · EPSS 0.3% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • cms

    Versions
    • >= 6.0.0, < 6.2.3: Affected

    No fix published

  • statamic/cms Packagist

    Versions
    • v6.0.0
    • v6.1.0
    • v6.2.0
    • v6.2.1
    • v6.2.2
    Affected ranges
    • ECOSYSTEM: ≥ 6.0.0, < 6.2.3

    Update to 6.2.3

Original sources

Check your server →