Skip to content
CVE PROGRAM SOURCE RECORD6.1 Medium

CVE-2026-33883

Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, the `user:reset_password_form` tag could render user-input directly into HTML without escaping, allowing an attacker to craft a URL that executes arbitrary JavaScript in the victim's browser. This has been fixed in 5.73.16 and 6.7.2.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

statamic cms

  • < 5.73.16affected
  • >= 6.0.0-alpha.1, < 6.7.2affected

References