Packagist/statamic/cms CVE-2026-25759: high 8.7, EPSS 0.51%
Statamic CMS vulnerable to privilege escalation via stored cross-site scripting
Action: Upgrade statamic/cms to 6.2.3 or later.
composer require statamic/cms:6.2.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 6.0.0 | 6.2.3 | - |
Fixed versions
| 6.2.3 |
Sources
- osv: GHSA-ff9r-ww9c-43x8
- https://github.com/statamic/cms/security/advisories/GHSA-ff9r-ww9c-43x8
- https://nvd.nist.gov/vuln/detail/CVE-2026-25759
- https://github.com/statamic/cms/commit/6ed4f65f3387686d6dbd816e9b4f18a8d9736ff6
- https://github.com/statamic/cms
- https://github.com/statamic/cms/releases/tag/v6.2.3
CVE-2026-25759 · published · modified · JSON