CVE-2026-27196

Description

Statmatic is a Laravel and Git powered content management system (CMS). Versions 5.73.8 and below in addition to 6.0.0-alpha.1 through 6.3.1 have a Stored XSS vulnerability in html fieldtypes which allows authenticated users with field management permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. This issue has been fixed in 6.3.2 and 5.73.9.

PUBLISHED Reserved 2026-02-18 | Published 2026-02-21 | Updated 2026-02-24 | Assigner GitHub_M

Problem types

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

References

github.com/...ic/cms/security/advisories/GHSA-8r7r-f4gm-wcpq

github.com/...ommit/11ae40e62edd3da044d37ebf264757a09cc2347b

github.com/...ommit/6c270dacc2be02bfc2eee500766f3309f59d47b3

cve.org (CVE-2026-27196)

nvd.nist.gov (CVE-2026-27196)

Download JSON