CVE-2026-33883

MEDIUM

Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag

Title source: cna
STIX 2.1

Description

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, the `user:reset_password_form` tag could render user-input directly into HTML without escaping, allowing an attacker to craft a URL that executes arbitrary JavaScript in the victim's browser. This has been fixed in 5.73.16 and 6.7.2.

References (1)

Core 1
Core References

Scores

CVSS v3 6.1
EPSS 0.0015
EPSS Percentile 4.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (4)
statamic/cms 0 - 5.73.16Packagist
statamic/cms < 5.73.16
statamic/cms >= 6.0.0-alpha.1, < 6.7.2
statamic/statamic < 5.73.16
Published Mar 27, 2026
Tracked Since Mar 29, 2026