CVE-2026-33883

MEDIUM SEVERITY

CVSS Score & Metrics

Base Score

6.1 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N                                    

Vulnerability Description

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, the `user:reset_password_form` tag could render user-input directly into HTML without escaping, allowing an attacker to craft a URL that executes arbitrary JavaScript in the victim's browser. This has been fixed in 5.73.16 and 6.7.2.

Vulnerability Details

Published Date

March 26, 2026

Last Modified

March 30, 2026

CWE ID

CWE-79

Source

GitHub

Vendor

composer

Product

statamic/cms

External References

https://github.com/statamic/cms/security/advisories/GHSA-3jg4-p23x-p4qx
https://github.com/advisories/GHSA-3jg4-p23x-p4qx

CVE-2026-33883

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment