8.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33172

CVE-2026-33172: Statamic has Stored XSS via SVG Sanitization Bypass

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, a stored XSS vulnerability in SVG asset reuploads allows authenticated users with asset upload permissions to bypass SVG sanitization and inject malicious JavaScript that executes when the asset is viewed. This has been fixed in 5.73.14 and 6.7.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33172

CVE-2026-33172:

8.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
statamic/cms	composer	>= 6.0.0-alpha.1, < 6.7.0	6.7.0
statamic/cms	composer	< 5.73.14	5.73.14

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, a stored Cross-Site Scripting (XSS) issue, exists in the Statamic CMS because it failed to properly sanitize SVG files during re-upload. An attacker with permissions to upload assets could replace a benign SVG file with a malicious one containing JavaScript. When this SVG is viewed, the script would execute in the user's browser.

The analysis of the security patches for versions 5.73.14 and 6.7.0 reveals that the core of the vulnerability is in the reupload method of the Statamic\Assets\Asset class. The patches introduce a new code block that explicitly checks if the re-uploaded file is an SVG and, if so, sanitizes its content using DOMSanitizer before saving it. The absence of this sanitization step in the vulnerable versions is what allowed the XSS attack. Therefore, the Statamic\Assets\Asset::reupload function is the key vulnerable function that would appear in a runtime profile during exploitation.

Vulnerable functions

Statamic\Assets\Asset::reupload

src/Assets/Asset.php

The vulnerability lies in the `reupload` function, which, prior to the patch, did not sanitize SVG files upon re-upload. This allowed authenticated users with asset upload permissions to inject malicious JavaScript into an SVG file. The patch adds a sanitization step for SVG files within this function to mitigate the stored XSS vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.