PT-2026-25092 · Git+2 · Cms+2

Shirshaw64P · Published 2026-03-12 · Updated 2026-03-14 · CVE-2026-32612

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Statamic versions prior to 6.6.2

Description Statamic is a Laravel and Git powered content management system (CMS). A stored cross-site scripting (XSS) issue exists in the control panel color mode preference. This allows authenticated users with control panel access to inject malicious JavaScript. The injected JavaScript executes when a higher-privileged user impersonates their account. The issue allows for potential privilege escalation.

Recommendations Versions prior to 6.6.2 should be updated to version 6.6.2 or later.

Exploit

Fix

LPE

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-32612

GHSA-HCCH-W73C-JP4M

Affected Products

Cms

Statamic

Statamic Cms

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32612.json · Exploit
• 🔥 https://github.com/Shirshaw64p/security-advisories/tree/main/CVE-2026-32612 · Exploit
• https://github.com/statamic/cms/security/advisories/GHSA-hcch-w73c-jp4m · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32612 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hcch-w73c-jp4m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32612 · Security Note
• https://github.com/statamic/cms · Note
• https://t.me/CVEtracker/47311 · Telegram Post
• https://twitter.com/CVEnew/status/2032230633603264956 · Twitter Post
• https://twitter.com/dailycve/status/2032900928022495245 · Twitter Post
• https://twitter.com/cyberbivash/status/2032265835587256516 · Twitter Post