Statamic CMS is vulnerable to stored cross-site scripting, allowing authenticated users with specific permissions to execute malicious JavaScript in the context of higher-privileged users.

This is a stored cross-site scripting (XSS) flaw within the html fieldtypes component. It allows an authenticated user with field management privileges to inject malicious payloads that execute when viewed by an administrator or other high-privileged user.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of a higher-privileged user, potentially leading to unauthorized administrative actions, session hijacking, or sensitive data theft. Given the CVSS score of 8.1, this represents a high-severity risk that could compromise the integrity and confidentiality of the entire content management environment.

Immediate Action: Update Statamic CMS to version 6.3.2 or 5.73.9 immediately to incorporate the necessary security patches.

Proactive Monitoring: Review administrative audit logs for unusual field configuration changes or anomalous activity originating from accounts with field management permissions.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall (WAF) to detect and block common XSS injection patterns.

Public Exploit Available: No (exploit_available: unknown)

This vulnerability presents a significant risk to the security posture of the Statamic CMS platform by allowing privileged users to be targeted by malicious scripts. It is imperative that administrators verify their current installation version and apply the provided updates to versions 6.3.2 or 5.73.9 without delay. Failure to patch may allow unauthorized users to compromise administrative accounts, leading to full system control.