CVE-2026-33883: Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag
Impact
The user:resetpasswordform tag could render user-input directly into HTML without escaping, allowing an attacker to craft a URL that executes arbitrary JavaScript in the victim's browser.
Patches
This has been fixed in 5.73.16 and 6.7.2.
Other sources
Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, the user:resetpasswordform tag could render user-input directly into HTML without escaping, allowing an attacker to craft a URL that executes arbitrary JavaScript in the victim's browser. This has been fixed in 5.73.16 and 6.7.2.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33883?
CVE-2026-33883 is classified as a reflected cross-site scripting (XSS) vulnerability.
How do I fix CVE-2026-33883?
To fix CVE-2026-33883, you should upgrade to Statamic version 6.7.2 or 5.73.16 depending on your current version.
What types of software are affected by CVE-2026-33883?
CVE-2026-33883 affects Statamic CMS versions between 6.0.0-alpha.1 and 6.7.2, as well as versions below 5.73.16.
How does CVE-2026-33883 allow for an attack?
CVE-2026-33883 allows attackers to exploit unescaped user input in the `user:reset_password_form` tag to execute arbitrary JavaScript.
What are potential consequences of CVE-2026-33883 being exploited?
Exploitation of CVE-2026-33883 can lead to unauthorized actions on behalf of the victim or exposure of sensitive information through the execution of malicious scripts.