CVE-2026-25759

Katalog CVE

CVSS 8.7 · High EPSS 0,51%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada statamic. Skor CVSS 3.1 8.7 (High) menurut github.com.

Deskripsi (NVD)

Statmatic is a Laravel and Git powered content management system (CMS). From 6.0.0 to before 6.2.3, a stored XSS vulnerability in content titles allows authenticated users with content creation permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. Malicious user must have an account with control panel access and content creation permissions. This vulnerability can be exploited to allow super admin accounts to be created. This has been fixed in 6.2.3.

Rincian

Terbit di NVD

11 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.7 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,51% peluang dieksploitasi; lebih tinggi dari 41,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/statamic/cms/security/advisories/GHSA-ff9r-ww9c-43x8 advisory vendor
• https://github.com/statamic/cms/commit/6ed4f65f3387686d6dbd816e9b4f18a8d9736ff6 patch · product
• https://github.com/statamic/cms/releases/tag/v6.2.3 release notes