TI-2025-39563 Aliases CVE-2025-64112 GHSA-g59r-24g3-h7cm

Statmatic vulnerable to Stored Cross-Site Scripting

LOW 37CWE-79Published 2025-10-30 · Updated 2025-10-30

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Statmatic is a Laravel and Git powered content management system (CMS). Stored XSS vulnerabilities in Collections and Taxonomies allow authenticated users with content creation permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. This vulnerability is fixed in 5.22.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00305 23rd percentileScored 2026-11-07

Fix Fixed cms (statamic): 5.22.1statamic/cms (Packagist): 5.22.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
statamic	cms	before 5.22.1	5.22.1	Patch available	CNA
—	statamic/cms (Packagist)	before 5.22.1	5.22.1	Patch available	GHSA-g59r-24g3-h7cm

cms Vendorstatamic Affected before 5.22.1 Fixed in 5.22.1 Patch available CNA
statamic/cms (Packagist) Vendor— Affected before 5.22.1 Fixed in 5.22.1 Patch available GHSA-g59r-24g3-h7cm

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:statamic:statamic::::::::	—	—	statamic

cpe:2.3:a:statamic:statamic:*:*:*:*:*:*:*:* Versions — — ·statamic

Remediation

Fix · CNA cms (statamic) Fixed in 5.22.1
Fix · GHSA-g59r-24g3-h7cm statamic/cms (Packagist) Fixed in 5.22.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-64112
2026-10-03 Alias added: GHSA-g59r-24g3-h7cm

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-64112

Other 4

TI-2024-16191 Statamic account takeover via XSS and password reset link CVSS 3.1HIGH 8.2
TI-2023-18622 Statamic's Antlers sanitizer cannot effectively sanitize malicious SVG CVSS 3.1MEDIUM 5.5
TI-2021-20500 A Code Execution vulnerability exists in Statamic Version through 3.2.26 via… CVSS 3.1CRITICAL 9.8
TI-2023-25469 Statamic CMS remote code execution via front-end form uploads CVSS 3.1CRITICAL 9.8
TI-2023-26081 Remote code execution via form uploads in statamic/cms CVSS 3.1HIGH 8.8
TI-2026-21980 Statamic is vulnerable to account takeover via password reset link injection CVSS 3.1CRITICAL 9.3

See all 45 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences