CVE-2026-25759: Statamic CMS Stored XSS Vulnerability

CVE-2026-25759 Overview

CVE-2026-25759 is a stored Cross-Site Scripting (XSS) vulnerability affecting Statamic, a Laravel and Git powered content management system (CMS). The vulnerability exists in content titles and allows authenticated users with content creation permissions to inject malicious JavaScript code that executes when viewed by higher-privileged users in the control panel.

This stored XSS vulnerability is particularly dangerous because it can be leveraged for privilege escalation—an attacker with low-level content creation access can potentially compromise super admin accounts, leading to full administrative control over the CMS installation.

Critical Impact

Authenticated attackers can inject malicious JavaScript in content titles to compromise higher-privileged accounts, potentially enabling creation of super admin accounts and complete CMS takeover.

Affected Products

• Statamic CMS versions 6.0.0 to 6.2.2
• Statamic CMS installations with control panel access enabled
• Systems where multiple users have varying privilege levels

Discovery Timeline

• February 11, 2026 - CVE-2026-25759 published to NVD
• February 12, 2026 - Last updated in NVD database

Technical Details for CVE-2026-25759

Vulnerability Analysis

This stored XSS vulnerability (CWE-79) affects Statamic CMS versions from 6.0.0 to before 6.2.3. The vulnerability stems from improper sanitization of user-supplied content in title fields within the command palette component. When an authenticated user with content creation permissions crafts a malicious title containing JavaScript, the payload is stored in the database and later executed in the browser context of any user who views the content through the command palette interface.

The attack requires network access and user interaction, as a higher-privileged user must view the malicious content for the payload to execute. However, the scope is changed since the vulnerability impacts security domains beyond the vulnerable component—specifically allowing session hijacking and unauthorized administrative actions. The lack of proper HTML encoding in the command palette allows injected scripts to execute with the privileges of the viewing user.

Root Cause

The root cause lies in insufficient input sanitization and output encoding within the CommandPalette.vue component. Content titles were being rendered directly into the DOM without proper HTML escaping, allowing malicious JavaScript embedded in title fields to execute when the command palette displays search results or content listings.

Attack Vector

The attack follows a privilege escalation pattern through stored XSS:

1. An attacker with minimal control panel access creates or modifies content with a malicious JavaScript payload in the title field
2. The payload is stored in the backend database without adequate sanitization
3. When a super admin or higher-privileged user accesses the control panel and views the content (e.g., through search or the command palette), the malicious script executes
4. The script can perform actions as the victim user, including creating new super admin accounts, modifying site configuration, or exfiltrating session tokens

The fix introduces the escapeHtml function from the globals module to properly encode HTML entities before rendering content titles in the command palette:

 import { cva } from 'cva';
 import { Icon, Subheading } from '@/components/ui';
 import { router } from '@inertiajs/vue3';
+import { escapeHtml } from '@/bootstrap/globals.js';
 
 let metaPressed = ref(false);
 let open = ref(false);

Source: GitHub Commit

Detection Methods for CVE-2026-25759

Indicators of Compromise

• Unusual content titles containing JavaScript syntax such as <script>, onerror=, onload=, or other event handlers
• Unexpected admin account creation or privilege changes in the CMS audit logs
• Browser console errors indicating blocked or executed inline scripts when viewing content
• Suspicious outbound network requests from admin user sessions

Detection Strategies

• Implement Content Security Policy (CSP) headers to detect and block inline script execution attempts
• Monitor CMS audit logs for unexpected user creation, especially accounts with elevated privileges
• Review database content for titles containing HTML tags or JavaScript event handlers
• Deploy Web Application Firewall (WAF) rules to detect XSS patterns in form submissions

Monitoring Recommendations

• Enable verbose logging in Statamic to track content modifications and user session activities
• Configure alerts for new admin account creation or privilege escalation events
• Monitor client-side JavaScript errors that may indicate blocked XSS attempts
• Implement real-time monitoring for unusual control panel access patterns

How to Mitigate CVE-2026-25759

Immediate Actions Required

• Update Statamic CMS to version 6.2.3 or later immediately
• Review existing content titles for potentially malicious payloads and sanitize as needed
• Audit user accounts for unauthorized privilege escalations or unexpected admin accounts
• Implement Content Security Policy headers to provide defense-in-depth against XSS attacks

Patch Information

Statamic has released version 6.2.3 which addresses this vulnerability by implementing proper HTML escaping in the command palette component. The fix imports and applies the escapeHtml function to sanitize content titles before rendering them in the Vue component. Organizations should update to 6.2.3 or later immediately.

For detailed patch information, refer to the GitHub Security Advisory GHSA-ff9r-ww9c-43x8 and the v6.2.3 release notes.

Workarounds

• Restrict control panel access to only trusted users until the patch can be applied
• Implement strict Content Security Policy headers to block inline script execution
• Review and limit content creation permissions to minimize the attack surface
• Consider temporarily disabling the command palette feature if possible until patching is complete

# Example CSP header configuration for Apache
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';"

# Example CSP header configuration for Nginx
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';";