CVE-2026-28426 - Vulnerability Analysis

Overview

Statmatic < 5.73.11 and < 6.4.0 contains a stored XSS caused by improper sanitization in svg and icon components, letting authenticated users with permissions inject malicious JavaScript executed by higher-privileged users.

Severity & Score

Impact

Authenticated users can inject JavaScript that executes in higher-privileged users' browsers, potentially leading to session hijacking or privilege escalation.

Mitigation

Update to versions 5.73.11 or 6.4.0 or later.

References

• https://github.com/statamic/cms/releases/tag/v5.73.11
• https://github.com/statamic/cms/releases/tag/v6.4.0
• https://github.com/statamic/cms/security/advisories/GHSA-5vrj-wf7v-5wr7

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner