CVE-2026-33172: Statamic has Stored XSS via SVG Sanitization Bypass
Impact
Stored XSS vulnerability in SVG asset reuploads allows authenticated users with asset upload permissions to bypass SVG sanitization and inject malicious JavaScript that executes when the asset is viewed.
Patches
This has been fixed in 5.73.14 and 6.7.0.
Other sources
Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, a stored XSS vulnerability in SVG asset reuploads allows authenticated users with asset upload permissions to bypass SVG sanitization and inject malicious JavaScript that executes when the asset is viewed. This has been fixed in 5.73.14 and 6.7.0.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33172?
CVE-2026-33172 is classified as a stored XSS vulnerability, which can lead to significant security risks for affected users.
How do I fix CVE-2026-33172?
To remediate CVE-2026-33172, upgrade to Statamic CMS version 5.73.14 or 6.7.0.
Who is affected by CVE-2026-33172?
CVE-2026-33172 affects authenticated users with asset upload permissions in Statamic CMS.
What is the impact of CVE-2026-33172?
The impact of CVE-2026-33172 allows attackers to bypass SVG sanitization and execute malicious JavaScript when assets are viewed.
When was CVE-2026-33172 disclosed?
CVE-2026-33172 was disclosed as part of a security advisory related to Statamic CMS.