{"action":"Upgrade statamic/cms to 5.73.9 or later.","affected":[{"fixed":"6.3.2","introduced":"6.0.0-alpha.1"},{"fixed":"5.73.9","introduced":"0"}],"component":"statamic/cms","cve_ids":["CVE-2026-27196"],"ecosystem":"Packagist","epss":0.00323,"exploited":false,"fixed_versions":["6.3.2","5.73.9"],"ghsa_id":"GHSA-8r7r-f4gm-wcpq","id":"tcs_01M5KEZ9S15E96411AXJYKD5SZ","modified_at":"2026-02-23T23:43:50.042373Z","published_at":"2026-02-19T20:30:38Z","references":["https://osv.dev/vulnerability/GHSA-8r7r-f4gm-wcpq","https://github.com/statamic/cms/security/advisories/GHSA-8r7r-f4gm-wcpq","https://nvd.nist.gov/vuln/detail/CVE-2026-27196","https://github.com/statamic/cms/commit/11ae40e62edd3da044d37ebf264757a09cc2347b","https://github.com/statamic/cms/commit/6c270dacc2be02bfc2eee500766f3309f59d47b3","https://github.com/statamic/cms"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-8r7r-f4gm-wcpq","url":"https://osv.dev/vulnerability/GHSA-8r7r-f4gm-wcpq"}],"summary":"Statamic affected by privilege escalation via stored cross-site scripting"}