CVE-2026-27196
published 2026-02-21CVE-2026-27196: Statmatic is a Laravel and Git powered content management system (CMS). Versions 5.73.8 and below in addition to 6.0.0-alpha.1 through 6.3.1 have a Stored XSS…
PriorityP423medium4.8CVSS 3.1
AVNACLPRHUIRSCCLILAN
EPSS
0.28%
19.7th percentile
Statmatic is a Laravel and Git powered content management system (CMS). Versions 5.73.8 and below in addition to 6.0.0-alpha.1 through 6.3.1 have a Stored XSS vulnerability in html fieldtypes which allows authenticated users with field management permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. This issue has been fixed in 6.3.2 and 5.73.9.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| statamic | cms | < 5.73.9 | 5.73.9 |
| statamic | cms | — | — |
| statamic | cms | >= 0 < 5.73.9 | 5.73.9 |
| statamic | cms | >= 6.0.0-alpha.1 < 6.3.2 | 6.3.2 |
| statamic | statamic | < 5.73.9 | 5.73.9 |
| statamic | statamic | >= 6.0.0 < 6.3.2 | 6.3.2 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Statamic affected by privilege escalation via stored cross-site scripting
ghsa·2026-02-19
CVE-2026-27196 [HIGH] CWE-79 Statamic affected by privilege escalation via stored cross-site scripting
Statamic affected by privilege escalation via stored cross-site scripting
## Impact
Stored XSS vulnerability in `html` fieldtypes allow authenticated users with field management permissions to inject malicious JavaScript that executes when viewed by higher-privileged users.
## Patches
This has been fixed in 6.3.2 and 5.73.9.
OSV
Statamic affected by privilege escalation via stored cross-site scripting
osv·2026-02-19
CVE-2026-27196 [HIGH] Statamic affected by privilege escalation via stored cross-site scripting
Statamic affected by privilege escalation via stored cross-site scripting
## Impact
Stored XSS vulnerability in `html` fieldtypes allow authenticated users with field management permissions to inject malicious JavaScript that executes when viewed by higher-privileged users.
## Patches
This has been fixed in 6.3.2 and 5.73.9.
No detection rules found.
No public exploits indexed.
2026-02-21
Published