Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-vb35-2r2f-cqcf
Vulnerability ID VCID-vb35-2r2f-cqcf
Aliases CVE-2025-64112
GHSA-g59r-24g3-h7cm
Summary Statmatic is a Laravel and Git powered content management system (CMS). Stored XSS vulnerabilities in Collections and Taxonomies allow authenticated users with content creation permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. This vulnerability is fixed in 5.22.1.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2025-64112
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-g59r-24g3-h7cm
cvssv3.1 8.0 https://github.com/statamic/cms
generic_textual HIGH https://github.com/statamic/cms
cvssv3.1 8 https://github.com/statamic/cms/commit/e513751f433679ce698606e20c554a0c839987c1
cvssv3.1 8.0 https://github.com/statamic/cms/commit/e513751f433679ce698606e20c554a0c839987c1
generic_textual HIGH https://github.com/statamic/cms/commit/e513751f433679ce698606e20c554a0c839987c1
ssvc Track https://github.com/statamic/cms/commit/e513751f433679ce698606e20c554a0c839987c1
cvssv3.1 8.0 https://github.com/statamic/cms/releases/tag/v5.22.1
generic_textual HIGH https://github.com/statamic/cms/releases/tag/v5.22.1
cvssv3.1 8 https://github.com/statamic/cms/security/advisories/GHSA-g59r-24g3-h7cm
cvssv3.1 8.0 https://github.com/statamic/cms/security/advisories/GHSA-g59r-24g3-h7cm
cvssv3.1_qr HIGH https://github.com/statamic/cms/security/advisories/GHSA-g59r-24g3-h7cm
generic_textual HIGH https://github.com/statamic/cms/security/advisories/GHSA-g59r-24g3-h7cm
ssvc Track https://github.com/statamic/cms/security/advisories/GHSA-g59r-24g3-h7cm
cvssv3.1 8.0 https://nvd.nist.gov/vuln/detail/CVE-2025-64112
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2025-64112
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2025-64112
https://github.com/statamic/cms
https://github.com/statamic/cms/releases/tag/v5.22.1
CVE-2025-64112 https://nvd.nist.gov/vuln/detail/CVE-2025-64112
e513751f433679ce698606e20c554a0c839987c1 https://github.com/statamic/cms/commit/e513751f433679ce698606e20c554a0c839987c1
GHSA-g59r-24g3-h7cm https://github.com/advisories/GHSA-g59r-24g3-h7cm
GHSA-g59r-24g3-h7cm https://github.com/statamic/cms/security/advisories/GHSA-g59r-24g3-h7cm
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/statamic/cms
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/statamic/cms/commit/e513751f433679ce698606e20c554a0c839987c1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/statamic/cms/commit/e513751f433679ce698606e20c554a0c839987c1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-10-30T17:57:49Z/ Found at https://github.com/statamic/cms/commit/e513751f433679ce698606e20c554a0c839987c1
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/statamic/cms/releases/tag/v5.22.1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/statamic/cms/security/advisories/GHSA-g59r-24g3-h7cm
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/statamic/cms/security/advisories/GHSA-g59r-24g3-h7cm
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-10-30T17:57:49Z/ Found at https://github.com/statamic/cms/security/advisories/GHSA-g59r-24g3-h7cm
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2025-64112
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.10988
EPSS Score 0.00036
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:57:33.443665+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2025/64xxx/CVE-2025-64112.json 38.6.0