CVE-2026-27196

HIGH8.1EPSS 0.01%

Statamic affected by privilege escalation via stored cross-site scripting

Published: 2/19/2026Modified: 2/23/2026

Description

## Impact Stored XSS vulnerability in `html` fieldtypes allow authenticated users with field management permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. ## Patches This has been fixed in 6.3.2 and 5.73.9.

Affected packages (1)

CVSS scores

SourceVersionSeverityVector
osvCVSS 3.1HIGH8.1CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

References (5)