Security readout for executives and security teams
Plain-English summary
Statamic CMS versions before 5.73.11 and 6.0.0 through 6.3.x have a stored cross-site scripting flaw in SVG and icon-related components. A lower-privileged authenticated user with the right permissions could plant JavaScript that runs when a higher-privileged user views it, potentially leading to privilege escalation.
Executive priority
Prioritize patching for any internet-facing or multi-user Statamic CMS. The business risk is not broad remote takeover without login, but compromise of higher-privileged CMS users through stored content. Treat as high priority where content editors, partners, or contractors have authenticated access.
Technical view
CVE-2026-28426 is CWE-79 stored XSS in Statamic CMS. The advisory states malicious JavaScript can be injected through SVG and icon components and executed in another user’s browser. CVSS 3.1 is 8.7: network exploitable, low complexity, low privileges required, user interaction required, changed scope, high confidentiality and integrity impact.
Likely exposure
Exposure is limited to Statamic CMS deployments running versions below 5.73.11, or 6.x versions from 6.0.0 before 6.4.0. Risk is higher where non-administrator authenticated users can manage or upload SVG/icon-related content viewed by administrators or other privileged users.
Exploitation context
Sources do not state active exploitation, and this CVE is not marked as CISA KEV in the provided bundle. Exploitation requires an authenticated user with appropriate permissions and a higher-privileged user viewing the affected stored content. The main concern is account or privilege compromise through trusted CMS workflows.
Researcher notes
The public description identifies the affected component class but not detailed root cause or proof-of-concept material. Validate exposure through version checks and permission review rather than exploit reproduction. The fixed versions are explicitly named in the advisory: 5.73.11 and 6.4.0.
Mitigation direction
- Upgrade Statamic CMS 5.x to 5.73.11 or later.
- Upgrade Statamic CMS 6.x to 6.4.0 or later.
- Review vendor advisory and release notes before deployment.
- Restrict SVG and icon management permissions until patched.
- Audit recent CMS content changes by lower-privileged users.
Validation and detection
- Inventory Statamic CMS instances and record exact versions.
- Confirm no instance is below 5.73.11 on the 5.x branch.
- Confirm no 6.x instance is below 6.4.0.
- Review roles allowed to modify SVG or icon-related components.
- Check administrative content areas for suspicious recent SVG/icon changes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-28426 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N2.35.8Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.7HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/statamic/cms/security/advisories/GHSA-5vrj-wf7v-5wr7CVE reference · x_refsource_CONFIRM
- https://github.com/statamic/cms/releases/tag/v5.73.11CVE reference · x_refsource_MISC
- https://github.com/statamic/cms/releases/tag/v6.4.0CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.