{"action":"Upgrade statamic/cms to 5.22.1 or later.","affected":[{"fixed":"5.22.1","introduced":"0"}],"component":"statamic/cms","cve_ids":["CVE-2025-64112"],"ecosystem":"Packagist","epss":0.00305,"exploited":false,"fixed_versions":["5.22.1"],"ghsa_id":"GHSA-g59r-24g3-h7cm","id":"tcs_01M5KF2C3GN3B2VCHCASEW4B97","modified_at":"2025-10-30T20:19:28.777470Z","published_at":"2025-10-30T17:22:53Z","references":["https://osv.dev/vulnerability/GHSA-g59r-24g3-h7cm","https://github.com/statamic/cms/security/advisories/GHSA-g59r-24g3-h7cm","https://nvd.nist.gov/vuln/detail/CVE-2025-64112","https://github.com/statamic/cms/commit/e513751f433679ce698606e20c554a0c839987c1","https://github.com/statamic/cms","https://github.com/statamic/cms/releases/tag/v5.22.1"],"severity":{"label":"high","score":8},"sources":[{"source":"osv","source_id":"GHSA-g59r-24g3-h7cm","url":"https://osv.dev/vulnerability/GHSA-g59r-24g3-h7cm"}],"summary":"Statamic Vulnerable to Superadmin Account Takeover via Stored Cross-Site Scripting and Lack of Proper X-CSRF-TOKEN Server-Side Validation"}