CVE-2026-27196

Katalog CVE

CVSS 4.8 · Medium EPSS 0,37%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada statamic. Skor CVSS 3.1 4.8 (Medium) menurut NVD.

Deskripsi (NVD)

Statmatic is a Laravel and Git powered content management system (CMS). Versions 5.73.8 and below in addition to 6.0.0-alpha.1 through 6.3.1 have a Stored XSS vulnerability in html fieldtypes which allows authenticated users with field management permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. This issue has been fixed in 6.3.2 and 5.73.9.

Rincian

Terbit di NVD

21 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.8 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 29,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/statamic/cms/security/advisories/GHSA-8r7r-f4gm-wcpq advisory vendor
• https://github.com/statamic/cms/commit/11ae40e62edd3da044d37ebf264757a09cc2347b patch
• https://github.com/statamic/cms/commit/6c270dacc2be02bfc2eee500766f3309f59d47b3 patch