CVE-2026-27196: Statamic CMS Stored XSS Vulnerability

CVE-2026-27196 Overview

CVE-2026-27196 is a Stored Cross-Site Scripting (XSS) vulnerability affecting Statamic, a Laravel and Git powered content management system (CMS). The vulnerability exists in the HTML fieldtypes component, which allows authenticated users with field management permissions to inject malicious JavaScript code. When this injected content is viewed by higher-privileged users, the malicious script executes in their browser context, potentially leading to privilege escalation, session hijacking, or unauthorized administrative actions.

Critical Impact

Authenticated attackers with field management permissions can inject persistent malicious JavaScript that executes in the context of higher-privileged administrative users, enabling privilege escalation and potential full CMS compromise.

Affected Products

• Statamic CMS versions 5.73.8 and below
• Statamic CMS versions 6.0.0-alpha.1 through 6.3.1

Discovery Timeline

• 2026-02-21 - CVE-2026-27196 published to NVD
• 2026-02-23 - Last updated in NVD database

Technical Details for CVE-2026-27196

Vulnerability Analysis

This Stored XSS vulnerability (CWE-79) resides in the HTML fieldtype component of Statamic CMS. The underlying issue stems from the direct rendering of user-controlled HTML content without proper sanitization. In the vulnerable implementation, the Vue.js component responsible for rendering HTML fieldtypes used v-html directive to directly output configuration HTML without any filtering or encoding.

The exploitation scenario requires an authenticated attacker with field management permissions—a lower-privilege role that still has access to modify field configurations. By injecting malicious JavaScript into an HTML fieldtype configuration, the attacker can create a stored payload that persists in the CMS. When administrative users access the publish form containing the malicious field, the injected script executes with their session privileges.

This attack pattern is particularly dangerous in multi-user CMS environments where privilege separation is expected between content editors and administrators. The attacker can potentially steal administrative session tokens, perform unauthorized configuration changes, or create additional privileged accounts.

Root Cause

The root cause of this vulnerability is the absence of HTML sanitization in the HtmlFieldtype.vue component. The original implementation directly bound user-controlled configuration data to the DOM using Vue's v-html directive without any filtering:

<div v-html="config.html" />

This allowed any HTML content, including <script> tags and event handlers, to be rendered and executed in the browser context of users viewing the field.

Attack Vector

The attack is network-based and requires the attacker to have authenticated access with field management permissions. The attacker creates or modifies an HTML fieldtype, injecting malicious JavaScript into the HTML configuration. When a higher-privileged user (such as an administrator) views a publish form containing this field, the malicious script executes automatically.

The following patch demonstrates how the vulnerability was addressed in version 6.x by implementing DOMPurify sanitization:

-<template>
-    <div v-html="config.html" />
-</template>
+<script setup>
+import Fieldtype from '@/components/fieldtypes/fieldtype';
+import { computed } from 'vue';
+import DOMPurify from 'dompurify';
 
-<script>
-import Fieldtype from './Fieldtype.vue';
+const props = defineProps(Fieldtype.props);
 
-export default {
-    mixins: [Fieldtype],
-};
+const html = computed(() => props.config.sanitize ? DOMPurify.sanitize(props.config.html) : props.config.html);
 </script>
+
+<template>
+    <div v-html="html" />
+</template>

Source: GitHub Commit

The 5.x branch received a similar fix with mandatory sanitization:

 <template>
-    <div v-html="config.html" />
+    <div v-html="html" />
 </template>
 
 <script>
+import DOMPurify from 'dompurify';
+
 export default {
-    mixins: [Fieldtype]
+    mixins: [Fieldtype],
+    computed: {
+        html() {
+            return DOMPurify.sanitize(this.config.html);
+        }
+    }
 };
 </script>

Source: GitHub Commit

Detection Methods for CVE-2026-27196

Indicators of Compromise

• Suspicious JavaScript code in HTML fieldtype configurations, particularly containing event handlers like onerror, onload, or onclick
• Unexpected <script> tags or <iframe> elements in field configuration data
• Audit logs showing field configuration changes by users with limited permissions
• Browser console errors or network requests to external domains when viewing publish forms

Detection Strategies

• Implement content security policy (CSP) headers to detect and block inline script execution
• Enable Statamic's audit logging to monitor field configuration changes
• Deploy web application firewalls (WAF) with XSS detection rulesets
• Conduct regular code reviews of HTML fieldtype configurations for suspicious content

Monitoring Recommendations

• Monitor for unusual administrative actions following field configuration viewing events
• Track session anomalies that may indicate session token theft
• Alert on new administrator accounts or permission changes
• Review network traffic for unexpected data exfiltration to external endpoints

How to Mitigate CVE-2026-27196

Immediate Actions Required

• Upgrade Statamic CMS to version 6.3.2 or 5.73.9 immediately
• Audit all existing HTML fieldtype configurations for malicious content
• Review recent field configuration changes in the audit log
• Rotate administrative session tokens as a precaution
• Restrict field management permissions to only trusted users

Patch Information

The vulnerability has been fixed in Statamic CMS versions 6.3.2 and 5.73.9. The patches implement DOMPurify sanitization for all HTML content rendered in HTML fieldtypes. Organizations should upgrade to these versions immediately.

For version 6.x, a new configuration option sanitize was added to allow administrators to explicitly disable sanitization if required, though this is not recommended. Version 5.x applies sanitization unconditionally. Detailed patch information is available in the GitHub Security Advisory.

Workarounds

• Temporarily disable or remove HTML fieldtypes from all blueprints until patching is complete
• Restrict field management permissions to only highly trusted administrators
• Implement a strict Content Security Policy (CSP) that blocks inline script execution
• Use a web application firewall to filter potential XSS payloads in form submissions

# Composer command to update Statamic CMS
composer update statamic/cms

# Verify installed version
composer show statamic/cms | grep versions