PT-2026-20984 · Statmatic · Statmatic

Jasonvarga · Published 2026-02-19 · Updated 2026-02-22 · CVE-2026-27196

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Statamic versions 5.73.8 and below, and 6.0.0-alpha.1 through 6.3.1

Description Statamic, a Laravel and Git powered content management system (CMS), is affected by a Stored Cross-Site Scripting (XSS) issue in the html fieldtypes. This flaw allows authenticated users with field management permissions to inject malicious JavaScript code into content fields. When higher-privileged users view the affected content, the malicious script executes in their browsers, potentially leading to session hijacking or credential theft. The vulnerability allows for potential privilege escalation.

Recommendations Versions prior to 6.3.2 are vulnerable. Versions prior to 5.73.9 are vulnerable.

Exploit

Fix

LPE

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-27196

GHSA-8R7R-F4GM-WCPQ

Affected Products

Statmatic

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27196.json · Exploit
• https://github.com/statamic/cms/commit/11ae40e62edd3da044d37ebf264757a09cc2347b · Patch
• https://github.com/statamic/cms/commit/6c270dacc2be02bfc2eee500766f3309f59d47b3 · Patch
• https://github.com/statamic/cms/security/advisories/GHSA-8r7r-f4gm-wcpq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27196 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27196 · Security Note
• https://osv.dev/vulnerability/GHSA-8r7r-f4gm-wcpq · Vendor Advisory
• https://github.com/statamic/cms · Note
• https://twitter.com/TheHackerWire/status/2025078251941704036 · Twitter Post
• https://twitter.com/CVEnew/status/2025154194731139501 · Twitter Post
• https://twitter.com/CveTodo/status/2025080092163010663 · Twitter Post
• https://twitter.com/pulsepatchio/status/2025581046880715028 · Twitter Post