CVE-2026-25759

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-25759
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25759.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-25759
Aliases
Published
2026-02-11T20:37:37.741Z
Modified
2026-02-20T06:33:55.631669Z
Severity
  • 8.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N CVSS Calculator
Summary
Statmatic affected by privilege escalation via stored cross-site scripting
Details

Statmatic is a Laravel and Git powered content management system (CMS). From 6.0.0 to before 6.2.3, a stored XSS vulnerability in content titles allows authenticated users with content creation permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. Malicious user must have an account with control panel access and content creation permissions. This vulnerability can be exploited to allow super admin accounts to be created. This has been fixed in 6.2.3.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25759.json",
    "cwe_ids": [
        "CWE-79"
    ]
}
References

Affected packages

Git / github.com/statamic/cms

Affected ranges

Type
GIT
Repo
https://github.com/statamic/cms
Events
Introduced
d1bb31cfa1191226cee2a2d1e17aa4c25541e568
Fixed
2724468e1d305910fe16079a0ade8d83e8f13d62

Affected versions

v5.*
v5.73.3
v5.73.4
v5.73.5
v6.*
v6.0.0
v6.1.0
v6.2.0
v6.2.1
v6.2.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25759.json"