PT-2026-7714 · Statamic+1 · Statamic+1

Neosprings · Published 2026-02-11 · Updated 2026-02-18 · CVE-2026-25759

Positive Technologies · (AI Summary)

CVSS v3.1

8.7

High

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Statamic versions 6.0.0 through 6.2.2

Description Statamic is a Laravel and Git powered content management system (CMS). A stored cross-site scripting (XSS) issue exists in content titles, allowing authenticated users with content creation permissions to inject malicious JavaScript. This JavaScript executes when viewed by users with higher privileges. An attacker with content control panel access can exploit this to create super administrator accounts. The vulnerable component is the content title functionality. The affected API endpoint is not specified. The vulnerable parameter is not specified.

Recommendations Upgrade to version 6.2.3 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-25759

GHSA-FF9R-WW9C-43X8

Affected Products

Laravel

Statamic

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25759.json · Exploit
• https://github.com/statamic/cms/security/advisories/GHSA-ff9r-ww9c-43x8 · Vendor Advisory
• https://github.com/statamic/cms/commit/6ed4f65f3387686d6dbd816e9b4f18a8d9736ff6 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-25759 · Security Note
• https://osv.dev/vulnerability/GHSA-ff9r-ww9c-43x8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25759 · Vendor Advisory
• https://github.com/statamic/cms · Note
• https://github.com/statamic/cms/releases/tag/v6.2.3 · Note
• https://reddit.com/r/VulnMatter/comments/1r3pq3j/resumen_diario_de_vulnerabilidades_13022026 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1r3pptr/resumen_diario_de_vulnerabilidades_13022026 · Reddit Post
• https://t.me/cveNotify/152416 · Telegram Post
• https://twitter.com/_cvereports/status/2021730994735153159 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1r3ozdd/resumen_diario_de_vulnerabilidades_13022026 · Reddit Post
• https://twitter.com/CVEnew/status/2021689992880230665 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1r2tzxw/resumen_diario_de_vulnerabilidades_12022026 · Reddit Post