PT-2026-25092 · Git+2 · Cms+2

Shirshaw64P · Publicado 2026-03-12 · Atualizado 2026-03-14 · CVE-2026-32612

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Statamic versions prior to 6.6.2

Description Statamic is a Laravel and Git powered content management system (CMS). A stored cross-site scripting (XSS) issue exists in the control panel color mode preference. This allows authenticated users with control panel access to inject malicious JavaScript. The injected JavaScript executes when a higher-privileged user impersonates their account. The issue allows for potential privilege escalation.

Recommendations Versions prior to 6.6.2 should be updated to version 6.6.2 or later.

Exploit

Correção

LPE

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-32612

GHSA-HCCH-W73C-JP4M

Produtos afetados

Cms

Statamic

Statamic Cms

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32612.json · Exploit
• 🔥 https://github.com/Shirshaw64p/security-advisories/tree/main/CVE-2026-32612 · Exploit
• https://github.com/statamic/cms · Nota
• https://github.com/statamic/cms/security/advisories/GHSA-hcch-w73c-jp4m · Aviso do Fabricante
• https://t.me/CVEtracker/47311 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2032230633603264956 · Publicação no Twitter
• https://twitter.com/dailycve/status/2032900928022495245 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-32612 · Aviso do Fabricante
• https://twitter.com/cyberbivash/status/2032265835587256516 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-hcch-w73c-jp4m · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-32612 · Nota de Segurança