AIKIDO-2026-653298
statamic/cms is vulnerable to Cross-Site Scripting (XSS)
61
Medium Risk
This Affects:
statamic/cmsTL;DR
Uploaded SVG assets can retain content that causes a browser to run scripts when someone opens the stored file. A user who can upload assets, including through frontend forms, can embed scripts that run in the session of anyone who opens the file, such as a Control Panel user. The fix does not reprocess stored SVG assets. The fix blocks more unsafe SVG content and updates the dom-sanitizer dependency.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you accept SVG asset uploads.
Background info
statamic/cms is vulnerable to Cross-Site Scripting (XSS) in versions 0.0.1 - 5.74.4 and 6.0.0 - 6.35.0.
How to fix this
Upgrade the statamic/cms library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.