Statamic vulnerable to privilege escalation via stored cross-site scripting

Vulnerability

Overview

CVE-2026-28426 is a stored cross-site scripting (XSS) vulnerability in Statmatic, a Laravel and Git powered CMS. The flaw resides in the SVG and icon-related components, where insufficient sanitization of uploaded or embedded SVG content allows an authenticated user with appropriate permissions to inject arbitrary JavaScript. This malicious script is stored on the server and executed in the browser of any user who views the affected component, including higher-privileged users such as administrators [1][4].

Exploitation

Details

An attacker must have an authenticated account with permissions to upload or modify SVG files or icon configurations. The attack is network-based, requires low complexity, and does not require user interaction from the victim beyond viewing the compromised page. The vulnerability is classified with a CVSS v4.0 vector that reflects a scope change, as the injected script can affect resources beyond the vulnerable component [4]. The attacker can craft a malicious SVG that, when rendered, executes JavaScript in the context of the victim's session.

Impact

Successful exploitation enables privilege escalation: an attacker with lower privileges can execute arbitrary actions as a higher-privileged user, such as creating new admin accounts, modifying site content, or exfiltrating sensitive data. The stored nature of the XSS means the payload persists until removed, potentially affecting multiple victims [1][4].

Mitigation

The vulnerability has been patched in Statmatic versions 5.73.11 and 6.4.0. The fix includes sanitization of SVGs in the Icon component, as noted in the release notes for v6.4.0 [2]. Users are strongly advised to upgrade to these or later versions. No workarounds have been publicly documented, and the advisory recommends immediate patching [4].