8.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25759

CVE-2026-25759: Statmatic affected by privilege escalation via stored cross-site scripting

Statmatic is a Laravel and Git powered content management system (CMS). From 6.0.0 to before 6.2.3, a stored XSS vulnerability in content titles allows authenticated users with content creation permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. Malicious user must have an account with control panel access and content creation permissions. This vulnerability can be exploited to allow super admin accounts to be created. This has been fixed in 6.2.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25759

CVE-2026-25759:

8.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
statamic/cms	composer	>= 6.0.0, < 6.2.3	6.2.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue within the Statamic CMS, specifically in the command palette feature. The analysis of the security advisory and the associated patch in pull request #13825 reveals that the flaw was in how search results were handled and displayed.

The root cause is the lack of input sanitization in the CommandPalette.vue component. An authenticated user with permissions to create or edit content could insert a malicious JavaScript payload into a content title. When another user, particularly a higher-privileged one like an administrator, uses the command palette, the search functionality fetches these content titles. The vulnerable code, located in the results computed property, would then use the fuzzysort library to highlight matching text. Crucially, the fuzzysort.highlight function was called on the raw, unsanitized title. This process wrapped the malicious script in highlighting tags without escaping it, and the resulting HTML was rendered in the command palette, causing the script to execute in the administrator's browser. This could be leveraged for privilege escalation, such as creating a new admin user.

The patch addresses this by introducing a new function, highlightResult, which wraps the highlighting logic. This new function first calls escapeHtml on the text, ensuring that any embedded HTML or script tags are converted to inert text before the highlighting is applied. This prevents the browser from executing the malicious payload.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.