Stored XSS Vulnerability in Statamic CMS Affects Multiple Versions
CVE-2026-27196
8.1HIGH
What is CVE-2026-27196?
Statamic, a Laravel and Git powered content management system, has a vulnerability that allows authenticated users with field management permissions to inject malicious JavaScript into html fieldtypes. This malicious code executes when viewed by users with higher privileges, potentially compromising sensitive information. Versions affected include 5.73.8 and earlier, as well as 6.0.0-alpha.1 through 6.3.1. The vulnerability has been addressed in versions 6.3.2 and 5.73.9, underscoring the importance of timely updates to maintain web security.
Affected Version(s)
cms >= 6.0.0-alpha.1, < 6.3.2 < 6.0.0-alpha.1, 6.3.2
cms < 5.73.9 < 5.73.9