PT-2026-22428 · Statmatic · Statmatic

Jasonvarga · Published 2026-02-27 · Updated 2026-03-05 · CVE-2026-28426

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Statmatic versions prior to 5.73.11 Statmatic versions prior to 6.4.0

Description Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, a stored cross-site scripting (XSS) issue exists in the svg and icon related components. This allows authenticated users with appropriate permissions to inject malicious JavaScript that executes when viewed by higher-privileged users.

Recommendations Versions prior to 5.73.11 should be updated to version 5.73.11 or later. Versions prior to 6.4.0 should be updated to version 6.4.0 or later.

Exploit

Fix

LPE

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-28426

GHSA-5VRJ-WF7V-5WR7

Affected Products

Statmatic

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28426.json · Exploit
• https://github.com/statamic/cms/security/advisories/GHSA-5vrj-wf7v-5wr7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-28426 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28426 · Security Note
• https://osv.dev/vulnerability/GHSA-5vrj-wf7v-5wr7 · Vendor Advisory
• https://github.com/statamic/cms · Note
• https://github.com/statamic/cms/releases/tag/v5.73.11 · Note
• https://github.com/statamic/cms/releases/tag/v6.4.0 · Note
• https://twitter.com/TheHackerWire/status/2027531930917605854 · Twitter Post
• https://t.me/cveNotify/154333 · Telegram Post
• https://twitter.com/BinaryPh/status/2028213742232617367 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1rj3cki/resumen_diario_de_vulnerabilidades_02032026 · Reddit Post
• https://twitter.com/pulsepatchio/status/2027754734480761178 · Twitter Post
• https://twitter.com/CveFindCom/status/2027529514411081964 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2027551498851205447 · Twitter Post