We’re taking on a small number of new builds and rebuilds this quarter. Book a call to see if your project is a fit.

CVE CVE-2026-32612

CVE-2026-32612

Laravel

Severity: MEDIUM
CVSS: 5.4CVSS
Published: 2026-03-13
Last modified: 2026-03-19
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CWE: CWE-79

Description

Statamic is a Laravel and Git powered content management system (CMS). Prior to 6.6.2, stored XSS in the control panel color mode preference allows authenticated users with control panel access to inject malicious JavaScript that executes when a higher-privileged user impersonates their account. This has been fixed in 6.6.2.

References

https://github.com/Shirshaw64p/security-advisories/tree/main/CVE-2026-32612
https://github.com/statamic/cms/security/advisories/GHSA-hcch-w73c-jp4m

Summary

Description

References