PT-2025-44441 · Statmatic · Statmatic

Published 2025-10-30 · Updated 2025-11-01 · CVE-2025-64112

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Statmatic versions prior to 5.22.1

Description Statmatic is a Laravel and Git powered content management system (CMS). Stored cross-site scripting (XSS) issues exist in Collections and Taxonomies. Authenticated users with content creation permissions can inject malicious JavaScript. This JavaScript executes when viewed by users with higher privileges.

Recommendations Update to version 5.22.1 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-64112

GHSA-G59R-24G3-H7CM

Affected Products

Statmatic

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64112.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-64112 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g59r-24g3-h7cm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64112 · Security Note
• https://github.com/statamic/cms · Note
• https://github.com/statamic/cms/security/advisories/GHSA-g59r-24g3-h7cm · Note
• https://github.com/statamic/cms/commit/e513751f433679ce698606e20c554a0c839987c1 · Note
• https://github.com/statamic/cms/releases/tag/v5.22.1 · Note
• https://twitter.com/gN3mes1s/status/1984387405445828899 · Twitter Post
• https://twitter.com/CVEnew/status/1983962561448984589 · Twitter Post
• https://twitter.com/wojtekchwala/status/1984416697953239367 · Twitter Post
• https://t.me/CVEtracker/36216 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1983973379536240962 · Twitter Post