CVE-2026-25759
📋 TL;DR
A stored cross-site scripting (XSS) vulnerability in Statmatic CMS allows authenticated users with content creation permissions to inject malicious JavaScript into content titles. When higher-privileged users view these titles, the script executes, potentially allowing attackers to create super admin accounts. This affects Statmatic CMS versions 6.0.0 through 6.2.2.
💻 Affected Systems
- Statmatic CMS
📦 What is this software?
Statamic by Statamic
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain super admin privileges, leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Privilege escalation where attackers create unauthorized admin accounts to modify content, access sensitive data, or install backdoors.
If Mitigated
Limited impact with proper input validation and output encoding preventing script execution.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once permissions are obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.2.3
Vendor Advisory: https://github.com/statamic/cms/security/advisories/GHSA-ff9r-ww9c-43x8
Restart Required: No
Instructions:
1. Backup your Statmatic installation. 2. Update to version 6.2.3 via composer: 'composer require statamic/cms:^6.2.3'. 3. Clear Laravel cache: 'php artisan cache:clear'. 4. Verify the update with 'composer show statamic/cms'.
🔧 Temporary Workarounds
Input Sanitization
allImplement server-side validation to strip or encode HTML/JavaScript from content titles.
Content Title Filtering
allAdd middleware to sanitize title inputs before storage.
🧯 If You Can't Patch
- Restrict content creation permissions to trusted users only.
- Implement web application firewall (WAF) rules to block XSS payloads in title fields.
🔍 How to Verify
Check if Vulnerable:
Check Statmatic version via 'composer show statamic/cms' or review package.json; versions 6.0.0-6.2.2 are vulnerable.Check Version:
composer show statamic/cms | grep versionsVerify Fix Applied:
Confirm version is 6.2.3 or higher with 'composer show statamic/cms' and test title fields for XSS payloads.📡 Detection & Monitoring
Log Indicators:
- Unusual content title modifications, especially with script tags or JavaScript code.
Network Indicators:
- HTTP requests with suspicious payloads in title parameters.
SIEM Query:
source="web_logs" AND (title CONTAINS "<script>" OR title CONTAINS "javascript:")