CVE-2026-33172

HIGH

8.7

Description

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, a stored XSS vulnerability in SVG asset reuploads allows authenticated users with asset upload permissions to bypass SVG sanitization and inject malicious JavaScript that executes when the asset is viewed. This has been fixed in 5.73.14 and 6.7.0.

CVE Details

CVSS v3.1 Score8.7

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredLOW

User InteractionREQUIRED

Published3/20/2026

Last Modified3/23/2026

Sourcenvd

Honeypot Sightings0

Affected Products

statamic:statamic

Weaknesses (CWE)

CWE-79

References

https://github.com/statamic/cms/security/advisories/GHSA-7rcv-55mj-chg7(security-advisories@github.com)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.