PT-2026-26204 · Statamic · Statamic

Filipegaudard · Publicado 2026-03-18 · Atualizado 2026-03-21 · CVE-2026-33172

Positive Technologies (AI Summary)

CVSS v3.1

8.7

Alta

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Statamic versions prior to 5.73.14 Statamic versions prior to 6.7.0

Description Statamic is a Laravel and Git powered content management system (CMS). A stored cross-site scripting (XSS) issue exists in SVG asset reuploads. Authenticated users with asset upload permissions can bypass SVG sanitization and inject malicious JavaScript. This JavaScript executes when the asset is viewed.

Recommendations Update to Statamic version 5.73.14. Update to Statamic version 6.7.0.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-33172

GHSA-7RCV-55MJ-CHG7

Produtos afetados

Statamic

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33172.json · Exploit
• https://github.com/statamic/cms · Nota
• https://github.com/statamic/cms/security/advisories/GHSA-7rcv-55mj-chg7 · Aviso do Fabricante
• https://twitter.com/TheHackerWire/status/2035129258625180054 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2035125020091928724 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-7rcv-55mj-chg7 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2035262146087440867 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-33172 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-33172 · Nota de Segurança