CVE-2026-28426
Published: 27 February 2026
Summary
CVE-2026-28426 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Statamic Statamic. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 2.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Flaw remediation requires identifying, reporting, and patching vulnerabilities like the stored XSS in SVG/icon components, directly addressing the fixed versions 5.73.11 and 6.4.0.
Information output filtering prevents execution of injected malicious JavaScript in SVG and icon content when viewed by higher-privileged users.
Information input validation checks and sanitizes inputs to SVG and icon components, blocking malicious JavaScript injection by authenticated users.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS enables client-side JS execution in higher-privileged browser contexts (facilitating session hijacking/credential theft and priv-esc) and is exploitable as a public-facing web app vuln.
NVD Description
Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, stored XSS vulnerability in svg and icon related components allow authenticated users with appropriate permissions to inject malicious JavaScript that executes when viewed…
more
by higher-privileged users. This has been fixed in 5.73.11 and 6.4.0.
Deeper analysisAI
CVE-2026-28426 is a stored cross-site scripting (XSS) vulnerability, classified under CWE-79, affecting Statamic, a Laravel and Git-powered content management system (CMS). The flaw resides in SVG and icon-related components and impacts all versions prior to 5.73.11 and 6.4.0. It carries a CVSS v3.1 base score of 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), indicating high severity due to its potential for significant confidentiality and integrity impacts across a changed scope.
An authenticated attacker with appropriate permissions can exploit this vulnerability by injecting malicious JavaScript into the affected components. The payload persists as stored XSS and executes in the browser context of higher-privileged users, such as administrators, when they view the compromised SVG or icon content. This requires user interaction from the victim but enables remote network-based attacks with low complexity and low privileges on the attacker's part.
The vulnerability has been addressed in Statamic versions 5.73.11 and 6.4.0, as detailed in the project's release notes and security advisory GHSA-5vrj-wf7v-5wr7. Security practitioners should urge users to upgrade to these patched versions immediately to mitigate the risk.
Details
- CWE(s)