Sign in
Deutsch English Español Polski
Medium

Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag

  • Disclosed: 26.03.2026
  • Updated: 11.10.2026 10:22

Impact

The user:reset_password_form tag could render user-input directly into HTML without escaping, allowing an attacker to craft a URL that executes arbitrary JavaScript in the victim's browser.

Patches

This has been fixed in 5.73.16 and 6.7.2.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Composer package statamic/cms < 5.73.16, >= 6.0.0-alpha.1, < 6.7.2 5.73.16, 6.7.2

References

CVSS score 6.1/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness (CWE)
CWE-79
Platform
Composer
Package
statamic/cms
Disclosed
26.03.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-3jg4-p23x-p4qx - CC BY 4.0

Vulnerability history: statamic/cms

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (44) in the archive
Total entries
44
First → latest
03.2022 08.2026
Without a fix
1
Exploited in attacks
0

Severity breakdown

  • Critical 1
  • High 15
  • Medium 25
  • Low 3

Disclosures per year

Severity:
  1. Statamic: Account takeover via OAuth email matching without email-verification check
    High · 8.1 CVE-2026-64665 < 5.74.1, >= 6.0.0, < 6.24.0 5.74.1, 6.24.0
  2. Statamic CMS's unsafe method invocation via collection sorting allows data destruction
    High · 7.4 CVE-2026-49287 < 5.73.23, >= 6.0.0, < 6.20.0 5.73.23, 6.20.0
  3. Statamic: Unsafe method invocation via query value resolution allows data destruction
    High · 8.1 CVE-2026-41175 < 5.73.20, >= 6.0.0-alpha.1, < 6.13.0 5.73.20, 6.13.0
  4. Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag this entry
    Medium · 6.1 CVE-2026-33883 < 5.73.16, >= 6.0.0-alpha.1, < 6.7.2 5.73.16, 6.7.2
  5. Statamic has Stored XSS via SVG Sanitization Bypass
    High · 8.7 CVE-2026-33172 >= 6.0.0-alpha.1, < 6.7.0, < 5.73.14 6.7.0, 5.73.14
  6. Statamic vulnerable to privilege escalation via stored cross-site scripting
    High · 8.7 CVE-2026-28426 < 5.73.11, >= 6.0.0-alpha.1, < 6.4.0 5.73.11, 6.4.0
  7. Statamic vulnerable to remote code execution via Antlers-enabled control panel inputs
    High · 8.0 CVE-2026-28425 < 5.73.16, >= 6.0.0-alpha.1, < 6.7.2 5.73.16, 6.7.2
  8. Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass
    High · 8.8 CVE-2026-27939 >= 6.0.0, < 6.4.0 6.4.0
  9. Statamic is vulnerable to account takeover via password reset link injection
    Critical · 9.3 CVE-2026-27593 < 5.73.10, >= 6.0.0-alpha.1, < 6.7.1 5.73.10, 6.7.1
  10. Statamic affected by privilege escalation via stored cross-site scripting
    High · 8.1 CVE-2026-27196 >= 6.0.0-alpha.1, < 6.3.2, < 5.73.9 6.3.2, 5.73.9
  11. Statamic CMS vulnerable to privilege escalation via stored cross-site scripting
    High · 8.7 CVE-2026-25759 >= 6.0.0, < 6.2.3 6.2.3
  12. Statamic Vulnerable to Superadmin Account Takeover via Stored Cross-Site Scripting and Lack of Proper X-CSRF-TOKEN Server-Side Validation
    High · 8.0 CVE-2025-64112 < 5.22.1 5.22.1
  13. Statmic CMS vulnerable to account takeover via XSS and password reset link
    High · 8.2 CVE-2024-24570 >= 4.00, < 4.46.0, < 3.4.17 4.46.0, 3.4.17
  14. Cross-site Scripting via uploaded assets
    High · 7.5 CVE-2023-48701 < 3.4.15, >= 4.0.0, < 4.36.0 3.4.15, 4.36.0
  15. Statamic CMS vulnerable to remote code execution via form uploads
    High · 8.8 CVE-2023-48217 >= 4.0.0, < 4.34.0, < 3.4.14 4.34.0, 3.4.14
  16. Statamic CMS remote code execution via front-end form uploads
    High · 8.3 CVE-2023-47129 >= 4.0.0, < 4.33.0, < 3.4.13 4.33.0, 3.4.13
  17. Statamic framework Incorrect Permission Assignment
    High · 8.8 CVE-2017-11422 < 2.6.0 2.6.0

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.