8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27196

CVE-2026-27196: Statamic affected by privilege escalation via stored cross-site scripting

Impact

Stored XSS vulnerability in html fieldtypes allow authenticated users with field management permissions to inject malicious JavaScript that executes when viewed by higher-privileged users.

Patches

This has been fixed in 6.3.2 and 5.73.9.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27196

CVE-2026-27196:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
statamic/cms	composer	>= 6.0.0-alpha.1, < 6.3.2	6.3.2
statamic/cms	composer	< 5.73.9	5.73.9

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided patches indicates a stored Cross-Site Scripting (XSS) vulnerability within the Statamic CMS html fieldtype. The root cause is the unsafe rendering of user-provided HTML in a Vue component.

The primary vulnerable function is the rendering logic within resources/js/components/fieldtypes/HtmlFieldtype.vue. Before the patch, this component used v-html="config.html" to display content. The v-html directive in Vue renders raw HTML, and since the config.html value was not sanitized, it was possible for a user with permissions to manage field types to save malicious JavaScript code. This code would then execute in the browser of any user, including high-privileged administrators, who viewed the component in the control panel.

The patch addresses this by introducing the DOMPurify library to sanitize the HTML. A computed property html is added, which cleans the this.config.html value before it is passed to v-html. This ensures that any potentially malicious code is removed before rendering.

Additionally, the Statamic\Fieldtypes\Html::configFieldItems function in src/Fieldtypes/Html.php was modified. This backend function defines the configuration options for the fieldtype. The patch adds a 'sanitize' toggle. While this function doesn't render the HTML, it's the gateway for injecting the payload, making it a relevant function in the context of the vulnerability.

Vulnerable functions

HtmlFieldtype

resources/js/components/fieldtypes/HtmlFieldtype.vue

The vulnerability lies within the `HtmlFieldtype.vue` component. Prior to the patch, this component would render HTML content directly from its `config.html` property using the `v-html` directive. This allowed for stored Cross-Site Scripting (XSS) because it did not sanitize the HTML, permitting an attacker with appropriate permissions to inject malicious JavaScript. The patch mitigates this by introducing `DOMPurify` to sanitize the HTML content before it is rendered, thereby preventing the execution of any embedded malicious scripts.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.