AIKIDO-2026-845922
statamic/cms is vulnerable to Cross-Site Scripting (XSS)
61
Medium Risk
This Affects:
statamic/cmsTL;DR
Statamic sanitizes uploaded SVG files, but the sanitization check only ran for file extensions written in lowercase. An upload whose extension used uppercase characters or trailing whitespace bypassed sanitization. An unsanitized SVG could be stored on a public, web-accessible asset disk and execute script in the context of the site when viewed. The fix aligns the SVG sanitization check with the extension normalization.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your site accepts SVG uploads.
Background info
statamic/cms is vulnerable to Cross-Site Scripting (XSS) in versions 0.0.1 - 5.74.3 and 6.0.0 - 6.27.1.
How to fix this
Upgrade the statamic/cms library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant