8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-64112

CVE-2025-64112: Statamic Vulnerable to Superadmin Account Takeover via Stored Cross-Site Scripting and Lack of Proper X-CSRF-TOKEN Server-Side Validation

Impact

Stored XSS vulnerabilities in Collections and Taxonomies allow authenticated users with content creation permissions to inject malicious JavaScript that executes when viewed by higher-privileged users.

This affects:

Control panel users with permission to create or edit Collections and Taxonomies
Versions up to and including 5.22.0

The vulnerability can be exploited to:

Change a super admin's password (versions ≤ 5.21.0)
Change a super admin's email address to initiate password reset (version 5.22.0)
Gain unauthorized access to superadmin accounts

The attack requires:

An authenticated user with control panel and content creation permissions
A super admin to view the compromised content

Patches

This has been fixed in 5.22.1.

Credits

Statamic thanks Wojtek Chwala for responsibly reporting the identified issues and working with us as we addressed them.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-64112

CVE-2025-64112:

8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
statamic/cms	composer	<= 5.22.0	5.22.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue within the Statamic control panel. The root cause is the improper handling of user-supplied titles for Collections, Taxonomies, Forms, and User Groups. An authenticated user with permissions to create or edit these resources could set a malicious title containing a JavaScript payload formatted as a Vue.js template directive.

When a privileged user, such as a super admin, views the page displaying this malicious title, the Vue.js framework on the client-side would interpret and execute the script. The patch addresses this by adding the v-pre directive to the HTML <h1> tags that display these titles. This directive instructs Vue.js to skip the compilation of that element and its children, effectively treating the title as plain text and preventing the XSS from executing.

The vulnerable functions identified are the title() methods for the respective resource models. These methods are the source of the tainted data that is passed to the vulnerable view templates. While the vulnerability is technically in the view layer, a runtime profiler would show these title() methods in the call stack leading to the rendering of the malicious content.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

8

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-64112: Statamic Vulnerable to Superadmin Account Takeover via Stored Cross-Site Scripting and Lack of Proper X-CSRF-TOKEN Server-Side Validation

Impact

Patches

Credits

CVE-2025-64112:

8

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

CVE-2025-64112: Statamic Vulnerable to Superadmin Account Takeover via Stored Cross-Site Scripting and Lack of Proper X-CSRF-TOKEN Server-Side Validation

Impact

Patches

Credits

Basic Information

Basic Information

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

8

8

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI