8.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-28426

CVE-2026-28426: Statamic vulnerable to privilege escalation via stored cross-site scripting

Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, stored XSS vulnerability in svg and icon related components allow authenticated users with appropriate permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. This has been fixed in 5.73.11 and 6.4.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-28426

CVE-2026-28426:

8.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
statamic/cms	composer	< 5.73.11	5.73.11
statamic/cms	composer	>= 6.0.0-alpha.1, < 6.4.0	6.4.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue within the Statamic CMS, specifically related to how custom SVG icons are handled in the control panel navigation. Authenticated users with permissions to manage navigation could upload or specify a malicious SVG icon.

The analysis of the security patch f41c33297fb1b906694e02b4c2a22d3eac823df6 reveals two key areas where the vulnerability existed:

Backend (PHP): The Statamic\CP\Navigation\NavItem.svg() method was responsible for retrieving the SVG icon. It would return the raw SVG content without any sanitization. If a user provided a malicious SVG string as an icon (e.g., <svg onload=alert(1)>), this raw string would be saved and later rendered in the control panel for other users, including administrators, to view.
Frontend (Vue.js): The SvgIcon.vue component's evaluateIcon method would receive the SVG string (either as a custom icon or as the name prop). It then used this string directly as a Vue template to dynamically render the icon. This is dangerous because Vue will compile and render the template, executing any JavaScript embedded within it.

The patch addresses these issues by introducing sanitization at both levels:

On the backend, the rhukster/dom-sanitizer library is used within the newly added sanitizeSvg method to clean the SVG before it's returned by the NavItem::svg() method.
On the frontend, DOMPurify is used to sanitize the SVG string within the evaluateIcon method before it's used to create a dynamic Vue component.

Therefore, any runtime profile during the exploitation of this vulnerability would show calls to Statamic\CP\Navigation\NavItem.svg() on the server-side and SvgIcon.evaluateIcon() on the client-side, as these are the functions that directly process the malicious SVG input.

Vulnerable functions

Statamic\CP\Navigation\NavItem.svg

src/CP/Navigation/NavItem.php

The `svg()` method in the `NavItem` class was returning a raw SVG string directly from user-provided data (the icon). This allowed for the injection of malicious SVG content containing JavaScript, leading to a stored XSS vulnerability. The patch introduces sanitization by passing the SVG through the `sanitizeSvg` method.

SvgIcon.evaluateIcon

resources/js/components/SvgIcon.vue

The `evaluateIcon` method in the `SvgIcon.vue` component was dynamically creating a Vue component using a template string from `this.customIcon` or `this.name`. This input was not sanitized, allowing an attacker to provide a malicious SVG string with embedded JavaScript. When this component was rendered, the script would execute. The patch uses `DOMPurify.sanitize` to clean the input before creating the component.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.