PT-2025-32359 · Unknown · Statamic Core

Published 2025-08-08 · Updated 2025-08-13 · CVE-2020-9322

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Statamic Core versions prior to 2.11.8

Description The /users endpoint is susceptible to cross-site scripting (XSS), potentially allowing an attacker to add an administrator user. Exploitation can occur through Cross-Site Request Forgery (CSRF). Stored XSS can be triggered by injecting a JavaScript payload within the username field during account registration. Reflected XSS can be triggered via the /users API endpoint.

Recommendations Update to Statamic Core version 2.11.8 or later. As a temporary workaround, restrict access to the /users API endpoint. Sanitize the username input field during account registration to prevent the injection of JavaScript payloads.

Fix

CSRF

XSS

Weakness Enumeration

CWE-352

CWE-79

Related Identifiers

CVE-2020-9322

Affected Products

Statamic Core

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2020-9322 · Security Note
• https://twitter.com/CVEnew/status/1953823396866801746 · Twitter Post
• https://statamic.com/changelog#2.11.18 · Note
• https://gist.github.com/kernelsndrs/86b78e869d481566223914ec7d4fc881 · Note
• https://web.archive.org/web/20200304174034/www.statamic.com/changelog#2.11.18 · Note
• https://twitter.com/cracbot/status/1955585186143346784 · Twitter Post