CVE-2026-27196
Published: 21 February 2026
Summary
CVE-2026-27196 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Statamic Statamic. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Session Hijacking (T1185); ranked at the 2.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires validation of inputs to html fieldtypes to detect and reject or sanitize malicious JavaScript payloads before storage.
Mandates filtering or encoding of output from html fields to prevent execution of stored malicious scripts in viewers' browsers.
Ensures timely remediation of the stored XSS flaw by applying vendor patches such as 6.3.2 or 5.73.9.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS enables direct injection of JS into admin-viewed content, facilitating browser session hijacking (T1185), theft of web session cookies (T1539), and subsequent use of those cookies for alternate authentication (T1550.004).
NVD Description
Statmatic is a Laravel and Git powered content management system (CMS). Versions 5.73.8 and below in addition to 6.0.0-alpha.1 through 6.3.1 have a Stored XSS vulnerability in html fieldtypes which allows authenticated users with field management permissions to inject malicious…
more
JavaScript that executes when viewed by higher-privileged users. This issue has been fixed in 6.3.2 and 5.73.9.
Deeper analysisAI
CVE-2026-27196 is a Stored Cross-Site Scripting (XSS) vulnerability (CWE-79) in the html fieldtypes of Statamic, a Laravel and Git-powered content management system (CMS). It affects versions 5.73.8 and below, as well as 6.0.0-alpha.1 through 6.3.1. The vulnerability, published on 2026-02-21, carries a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N).
Authenticated users with field management permissions can exploit this by injecting malicious JavaScript into html fields. The payload is stored and executes in the browser of higher-privileged users who view the affected content, enabling potential theft of sensitive data or unauthorized actions in the victim's session context due to the changed scope.
The issue has been fixed in Statamic versions 6.3.2 and 5.73.9. Mitigation involves updating to these releases, as detailed in the GitHub security advisory at https://github.com/statamic/cms/security/advisories/GHSA-8r7r-f4gm-wcpq and the patching commits https://github.com/statamic/cms/commit/11ae40e62edd3da044d37ebf264757a09cc2347b and https://github.com/statamic/cms/commit/6c270dacc2be02bfc2eee500766f3309f59d47b3.
Details
- CWE(s)