CVE-2026-27196 Statamic affected by privilege escalation via stored Cross-site Scripting
Authenticated users with field management permissions can inject malicious JavaScript via stored XSS, leading to privilege escalation when viewed by higher-privileged users.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-27196?
CVE-2026-27196 is a high-severity cross-site scripting vulnerability in statamic cms, published on 21 Feb 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Statmatic is a Laravel and Git powered content management system (CMS). Versions 5.73.8 and below in addition to 6.0.0-alpha.1 through 6.3.1 have a Stored XSS vulnerability in html fieldtypes which allows authenticated users with field management permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. This issue has been fixed in 6.3.2 and 5.73.9.
Weakness: CWE-79
Which versions are affected by CVE-2026-27196?
4 open source packages ship an affected version, including statamic/cms. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
statamic/cms Packagist | All versions | 5.73.9 |
statamic/cms Packagist | All versions | 5.73.9 |
statamic/cms Packagist | From 6.0.0-alpha.1 | 6.3.2 |
statamic/cms Packagist | From 6.0.0-alpha.1 | 6.3.2 |
Products include Statamic Statamic.
How do I fix CVE-2026-27196?
Upgrade statamic/cms to a fixed version for your release line: 5.73.9 or 6.3.2.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-27196 being exploited?
There is no known exploitation of CVE-2026-27196 in the wild and no public exploit code.
Other vulnerabilities in statamic cms
- CVE-2021-45364 Code injection in n/a
- CVE-2026-27593 Statamic is vulnerable to account takeover via password reset link injection
- CVE-2026-27939 Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass
- CVE-2023-48217 Remote code execution via form uploads in statamic/cms
- CVE-2017-11422 Statamic framework Incorrect Permission Assignment
Sources
Also known as GHSA-8r7r-f4gm-wcpq.