CVE-2026-25759

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25759", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-05T18:35:52.357Z", "datePublished": "2026-02-11T20:37:37.741Z", "dateUpdated": "2026-02-12T21:18:56.237Z"}, "containers": {"cna": {"title": "Statmatic affected by privilege escalation via stored cross-site scripting", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/statamic/cms/security/advisories/GHSA-ff9r-ww9c-43x8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/statamic/cms/security/advisories/GHSA-ff9r-ww9c-43x8"}, {"name": "https://github.com/statamic/cms/commit/6ed4f65f3387686d6dbd816e9b4f18a8d9736ff6", "tags": ["x_refsource_MISC"], "url": "https://github.com/statamic/cms/commit/6ed4f65f3387686d6dbd816e9b4f18a8d9736ff6"}, {"name": "https://github.com/statamic/cms/releases/tag/v6.2.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/statamic/cms/releases/tag/v6.2.3"}], "affected": [{"vendor": "statamic", "product": "cms", "versions": [{"version": ">= 6.0.0, < 6.2.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-11T20:37:37.741Z"}, "descriptions": [{"lang": "en", "value": "Statmatic is a Laravel and Git powered content management system (CMS). From 6.0.0 to before 6.2.3, a stored XSS vulnerability in content titles allows authenticated users with content creation permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. Malicious user must have an account with control panel access and content creation permissions. This vulnerability can be exploited to allow super admin accounts to be created. This has been fixed in 6.2.3."}], "source": {"advisory": "GHSA-ff9r-ww9c-43x8", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-12T21:18:49.299315Z", "id": "CVE-2026-25759", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-12T21:18:56.237Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25759", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-12T21:18:49.299315Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-12T21:18:52.506Z"}}], "cna": {"title": "Statmatic affected by privilege escalation via stored cross-site scripting", "source": {"advisory": "GHSA-ff9r-ww9c-43x8", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "statamic", "product": "cms", "versions": [{"status": "affected", "version": ">= 6.0.0, < 6.2.3"}]}], "references": [{"url": "https://github.com/statamic/cms/security/advisories/GHSA-ff9r-ww9c-43x8", "name": "https://github.com/statamic/cms/security/advisories/GHSA-ff9r-ww9c-43x8", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/statamic/cms/commit/6ed4f65f3387686d6dbd816e9b4f18a8d9736ff6", "name": "https://github.com/statamic/cms/commit/6ed4f65f3387686d6dbd816e9b4f18a8d9736ff6", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/statamic/cms/releases/tag/v6.2.3", "name": "https://github.com/statamic/cms/releases/tag/v6.2.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Statmatic is a Laravel and Git powered content management system (CMS). From 6.0.0 to before 6.2.3, a stored XSS vulnerability in content titles allows authenticated users with content creation permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. Malicious user must have an account with control panel access and content creation permissions. This vulnerability can be exploited to allow super admin accounts to be created. This has been fixed in 6.2.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-11T20:37:37.741Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25759", "state": "PUBLISHED", "dateUpdated": "2026-02-12T21:18:56.237Z", "dateReserved": "2026-02-05T18:35:52.357Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-11T20:37:37.741Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "cms", "vendor": "statamic", "versions": [{"status": "affected", "version": ">= 6.0.0, < 6.2.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:statamic:statamic:*:*:*:*:*:*:*:*", "matchCriteriaId": "08046306-6614-476F-A450-B90A03160915", "versionEndExcluding": "6.2.3", "versionStartIncluding": "6.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Statmatic is a Laravel and Git powered content management system (CMS). From 6.0.0 to before 6.2.3, a stored XSS vulnerability in content titles allows authenticated users with content creation permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. Malicious user must have an account with control panel access and content creation permissions. This vulnerability can be exploited to allow super admin accounts to be created. This has been fixed in 6.2.3."}, {"lang": "es", "value": "Statmatic es un sistema de gesti\u00f3n de contenido (CMS) impulsado por Laravel y Git. Desde la 6.0.0 hasta antes de la 6.2.3, una vulnerabilidad de XSS almacenado en los t\u00edtulos de contenido permite a usuarios autenticados con permisos de creaci\u00f3n de contenido inyectar JavaScript malicioso que se ejecuta cuando es visto por usuarios con mayores privilegios. El usuario malicioso debe tener una cuenta con acceso al panel de control y permisos de creaci\u00f3n de contenido. Esta vulnerabilidad puede ser explotada para permitir la creaci\u00f3n de cuentas de superadministrador. Esto ha sido corregido en la 6.2.3."}], "id": "CVE-2026-25759", "lastModified": "2026-06-17T10:25:11.003", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 5.8, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25759", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-12T21:18:49.299315Z", "version": "2.0.3"}}]}, "published": "2026-02-11T21:16:19.097", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Product"], "url": "https://github.com/statamic/cms/commit/6ed4f65f3387686d6dbd816e9b4f18a8d9736ff6"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/statamic/cms/releases/tag/v6.2.3"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/statamic/cms/security/advisories/GHSA-ff9r-ww9c-43x8"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.0.0,6.2.3)"}}], "product": "cms", "vendor": "statamic"}], "analysis": {"en": {"generated_at": "2026-04-17T20:13:49.779212+00:00", "value": {"mitigation_remediation": ["Upgrade Statamic CMS to version 6.2.3 or later to eliminate the stored XSS flaw.", "Review and clean existing content titles that may contain malicious JavaScript before the upgrade to prevent accidental privilege escalation.", "Restrict content\u2011creation permissions to a minimal set of trusted users and enforce least\u2011privilege practices to reduce the risk of unauthorized script injection."], "summary": {"action": "Apply Patch", "impact": "Privilege Escalation via Stored XSS in Statamic CMS"}, "threat_synthesis": {"affected_systems": "The vulnerable application is Statamic CMS, a Laravel\u2011based content management system. All releases from version 6.0.0 up to but not including 6.2.3 are affected. Those operating these editions should verify the installed version and plan an update where applicable.", "description_and_impact": "A stored cross-site scripting flaw exists in content titles of Statamic CMS versions 6.0.0 through the pre-6.2.3 releases. When an authenticated user with content creation permissions injects malicious JavaScript into a title, the code runs in the context of higher\u2011privileged users who view that content. The injected script can exploit the system to create new super administrator accounts, effectively allowing an attacker to elevate their privileges. This weakness is identified as a Reflected Cross\u2011Site Scripting issue (CWE\u201179).", "risk_and_exploitability": "The CVSS score of 8.7 indicates a high severity vulnerability. However, the EPSS score is below 1%, suggesting a low probability of exploitation at the time of analysis, and the issue is not listed in the CISA KEV catalog. Exploitability requires the attacker to have a control\u2011panel account with content\u2011creation rights. Once authenticated, the attacker can inject malicious titles; when a higher\u2011privileged user views the content, the embedded script executes, enabling the creation of super\u2011admin accounts. The real\u2011world risk is therefore high for environments where content creation permissions are granted to untrusted users, but the exploitation window is limited by the authentication and role constraints outlined above."}}}}, "created": "2026-02-12T09:35:33.977563+00:00", "updated": "2026-04-17T20:15:27.007346+00:00", "vendors": ["statamic", "statamic$PRODUCT$cms"]}