{"id":"GHSA-ff9r-ww9c-43x8","aliases":["CVE-2026-25759"],"title":"Statamic CMS vulnerable to privilege escalation via stored cross-site scripting","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"HIGH","description":"### Impact\nStored XSS vulnerability in content titles allow authenticated users with content creation permissions to inject malicious JavaScript that executes when viewed by higher-privileged users.\n\nMalicious user must have an account with control panel access and content creation permissions.\n\nThis vulnerability can be exploited to allow super admin accounts to be created.\n\n### Patches\nThis has been fixed in 6.2.3.","severity":"high","score":8.7,"published":"2026-02-11T18:17:58.000Z","modified":"2026-02-11T23:48:56.160Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"statamic/cms","sources":[{"name":"OSV · GHSA-ff9r-ww9c-43x8","url":"https://osv.dev/vulnerability/GHSA-ff9r-ww9c-43x8"}],"ranges":[{"events":[{"introduced":"6.0.0"},{"fixed":"6.2.3"}],"type":"ECOSYSTEM"}],"versions":["v6.0.0","v6.1.0","v6.2.0","v6.2.1","v6.2.2"],"fixed":["6.2.3"]}],"sourceAffected":[],"references":["https://github.com/statamic/cms/security/advisories/GHSA-ff9r-ww9c-43x8","https://nvd.nist.gov/vuln/detail/CVE-2026-25759","https://github.com/statamic/cms/commit/6ed4f65f3387686d6dbd816e9b4f18a8d9736ff6","https://github.com/statamic/cms","https://github.com/statamic/cms/releases/tag/v6.2.3"],"sources":[{"name":"OSV","id":"GHSA-ff9r-ww9c-43x8","modified":"2026-02-11T23:48:56.160099Z","url":"https://osv.dev/vulnerability/GHSA-ff9r-ww9c-43x8"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","score":8.7}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T23:25:34.350Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}