CVE-2026-27196
Statamic affected by privilege escalation via stored Cross-site Scripting
Statmatic is a Laravel and Git powered content management system (CMS). Versions 5.73.8 and below in addition to 6.0.0-alpha.1 through 6.3.1 have a Stored XSS vulnerability in html fieldtypes which allows authenticated users with field management permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. This issue has been fixed in 6.3.2 and 5.73.9.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Statamic affected by privilege escalation via stored Cross-site Scripting
Statmatic is a Laravel and Git powered content management system (CMS). Versions 5.73.8 and below in addition to 6.0.0-alpha.1 through 6.3.1 have a Stored XSS vulnerability in html fieldtypes which allows authenticated users with field management permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. This issue has been fixed in 6.3.2 and 5.73.9.
- Record
CVE-2026-27196- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2026-7739
Statmatic is a Laravel and Git powered content management system (CMS). Versions 5.73.8 and below in addition to 6.0.0-alpha.1 through 6.3.1 have a Stored XSS vulnerability in html fieldtypes which allows authenticated users with field management permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. This issue has been fixed in 6.3.2 and 5.73.9.
- Record
EUVD-2026-7739- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-8r7r-f4gm-wcpq
Statamic affected by privilege escalation via stored cross-site scripting
Impact
Stored XSS vulnerability in html fieldtypes allow authenticated users with field management permissions to inject malicious JavaScript that executes when viewed by higher-privileged users.
Patches
This has been fixed in 6.3.2 and 5.73.9.
- Record
GHSA-8r7r-f4gm-wcpq- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
Statmatic is a Laravel and Git powered content management system (CMS). Versions 5.73.8 and below in addition to 6.0.0-alpha.1 through 6.3.1 have a Stored XSS vulnerability in html fieldtypes which allows authenticated users with field management permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. This issue has been fixed in 6.3.2 and 5.73.9.
- Record
CVE-2026-27196- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N - CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Statamic affected by privilege escalation via stored Cross-site Scripting
Statmatic is a Laravel and Git powered content management system (CMS). Versions 5.73.8 and below in addition to 6.0.0-alpha.1 through 6.3.1 have a Stored XSS vulnerability in html fieldtypes which allows authenticated users with field management permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. This issue has been fixed in 6.3.2 and 5.73.9.
- Record
CVE-2026-27196- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-8r7r-f4gm-wcpq
Statamic affected by privilege escalation via stored cross-site scripting
Impact
Stored XSS vulnerability in html fieldtypes allow authenticated users with field management permissions to inject malicious JavaScript that executes when viewed by higher-privileged users.
Patches
This has been fixed in 6.3.2 and 5.73.9.
- Record
GHSA-8r7r-f4gm-wcpq- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
statamic/cmsPackagist |
6.0.0-alpha.1 up to 6.3.2 | 6.3.2 |
statamic/cmsPackagist |
before 5.73.9 | 5.73.9 |
statamic/cmsPackagist |
6.0.0-alpha.1 up to 6.3.2, plus listed versions v6.0.0v6.0.0-alpha.1v6.0.0-alpha.10v6.0.0-alpha.11v6.0.0-alpha.12 Show 32 moreShow lessv6.0.0-alpha.13v6.0.0-alpha.14v6.0.0-alpha.15v6.0.0-alpha.16v6.0.0-alpha.17v6.0.0-alpha.18v6.0.0-alpha.19v6.0.0-alpha.2v6.0.0-alpha.20v6.0.0-alpha.21v6.0.0-alpha.3v6.0.0-alpha.4v6.0.0-alpha.5v6.0.0-alpha.6v6.0.0-alpha.7v6.0.0-alpha.8v6.0.0-alpha.9v6.0.0-beta.1v6.0.0-beta.2v6.0.0-beta.3v6.0.0-beta.4v6.0.0-beta.5v6.0.0-beta.6v6.1.0v6.2.0v6.2.1v6.2.2v6.2.3v6.2.4v6.2.5v6.3.0v6.3.1 |
6.3.2 |
statamic/cmsPackagist |
before 5.73.9, plus listed versions v3.0.0v3.0.0-beta.1v3.0.0-beta.10v3.0.0-beta.11v3.0.0-beta.12 Show 45 moreShow lessv3.0.0-beta.13v3.0.0-beta.14v3.0.0-beta.15v3.0.0-beta.16v3.0.0-beta.17v3.0.0-beta.18v3.0.0-beta.19v3.0.0-beta.2v3.0.0-beta.20v3.0.0-beta.21v3.0.0-beta.22v3.0.0-beta.23v3.0.0-beta.24v3.0.0-beta.25v3.0.0-beta.26v3.0.0-beta.27v3.0.0-beta.28v3.0.0-beta.29v3.0.0-beta.3v3.0.0-beta.30v3.0.0-beta.31v3.0.0-beta.32v3.0.0-beta.33v3.0.0-beta.34v3.0.0-beta.35v3.0.0-beta.36v3.0.0-beta.37v3.0.0-beta.38v3.0.0-beta.39v3.0.0-beta.4v3.0.0-beta.40v3.0.0-beta.41v3.0.0-beta.42v3.0.0-beta.43v3.0.0-beta.44v3.0.0-beta.45v3.0.0-beta.46v3.0.0-beta.5v3.0.0-beta.6v3.0.0-beta.7v3.0.0-beta.8v3.0.0-beta.9v3.0.1v3.0.10v3.0.11 |
5.73.9 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-27196 is a high vulnerability (CVSS 8.1) in Statamic Cms, published February 19, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 25th percentile. Fixed in statamic/cms 6.3.2.
References
github.com/statamic/cms/security/advisories/GHSA-8r7r-f4gm-wcpq
nvd.nist.gov/vuln/detail/CVE-2026-27196
Left out here: 431 versions. The JSON record has them.