Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-2pmt-5bu3-6qfd
Vulnerability ID VCID-2pmt-5bu3-6qfd
Aliases CVE-2025-64112
GHSA-g59r-24g3-h7cm
Summary Statamic Vulnerable to Superadmin Account Takeover via Stored Cross-Site Scripting and Lack of Proper X-CSRF-TOKEN Server-Side Validation Stored XSS vulnerabilities in Collections and Taxonomies allow authenticated users with content creation permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. This affects: - Control panel users with permission to create or edit Collections and Taxonomies - Versions up to and including 5.22.0 The vulnerability can be exploited to: - Change a super admin's password (versions ≤ 5.21.0) - Change a super admin's email address to initiate password reset (version 5.22.0) - Gain unauthorized access to superadmin accounts The attack requires: - An authenticated user with control panel and content creation permissions - A super admin to view the compromised content
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2025-64112
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-g59r-24g3-h7cm
cvssv3.1 8.0 https://github.com/statamic/cms
generic_textual HIGH https://github.com/statamic/cms
cvssv3.1 8 https://github.com/statamic/cms/commit/e513751f433679ce698606e20c554a0c839987c1
cvssv3.1 8.0 https://github.com/statamic/cms/commit/e513751f433679ce698606e20c554a0c839987c1
generic_textual HIGH https://github.com/statamic/cms/commit/e513751f433679ce698606e20c554a0c839987c1
ssvc Track https://github.com/statamic/cms/commit/e513751f433679ce698606e20c554a0c839987c1
cvssv3.1 8.0 https://github.com/statamic/cms/releases/tag/v5.22.1
generic_textual HIGH https://github.com/statamic/cms/releases/tag/v5.22.1
cvssv3.1 8 https://github.com/statamic/cms/security/advisories/GHSA-g59r-24g3-h7cm
cvssv3.1 8.0 https://github.com/statamic/cms/security/advisories/GHSA-g59r-24g3-h7cm
cvssv3.1_qr HIGH https://github.com/statamic/cms/security/advisories/GHSA-g59r-24g3-h7cm
generic_textual HIGH https://github.com/statamic/cms/security/advisories/GHSA-g59r-24g3-h7cm
ssvc Track https://github.com/statamic/cms/security/advisories/GHSA-g59r-24g3-h7cm
cvssv3.1 8.0 https://nvd.nist.gov/vuln/detail/CVE-2025-64112
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2025-64112
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2025-64112
https://github.com/statamic/cms
https://github.com/statamic/cms/commit/e513751f433679ce698606e20c554a0c839987c1
https://github.com/statamic/cms/releases/tag/v5.22.1
CVE-2025-64112 https://nvd.nist.gov/vuln/detail/CVE-2025-64112
GHSA-g59r-24g3-h7cm https://github.com/advisories/GHSA-g59r-24g3-h7cm
GHSA-g59r-24g3-h7cm https://github.com/statamic/cms/security/advisories/GHSA-g59r-24g3-h7cm
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/statamic/cms
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/statamic/cms/commit/e513751f433679ce698606e20c554a0c839987c1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/statamic/cms/commit/e513751f433679ce698606e20c554a0c839987c1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-10-30T17:57:49Z/ Found at https://github.com/statamic/cms/commit/e513751f433679ce698606e20c554a0c839987c1
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/statamic/cms/releases/tag/v5.22.1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/statamic/cms/security/advisories/GHSA-g59r-24g3-h7cm
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/statamic/cms/security/advisories/GHSA-g59r-24g3-h7cm
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-10-30T17:57:49Z/ Found at https://github.com/statamic/cms/security/advisories/GHSA-g59r-24g3-h7cm
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2025-64112
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.11014
EPSS Score 0.00036
Published At June 5, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-02T04:48:23.918090+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/statamic/cms/CVE-2025-64112.yml 38.6.0