A stored cross-site scripting vulnerability in Statamic CMS allows authenticated users to execute malicious JavaScript, potentially leading to unauthorized actions by higher-privileged administrators.

This is a stored XSS vulnerability (CWE-79) affecting SVG and icon-related components. An authenticated user with sufficient permissions can inject malicious scripts that execute when a higher-privileged user views the affected content.

Successful exploitation allows an attacker to perform actions on behalf of a higher-privileged user, such as an administrator, which could lead to full account takeover or unauthorized system configuration changes. With a CVSS score of 8.7, this vulnerability represents a high risk to the integrity and security of the CMS environment, as it facilitates privilege escalation through browser-based exploitation.

Immediate Action: Update Statamic CMS to version 5.73.11 or 6.4.0 immediately to apply the vendor-provided patch.

Proactive Monitoring: Review administrative audit logs for suspicious activity or unauthorized changes made to pages or templates containing icons and SVG elements.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of inline scripts and ensure that only authorized domains can load external resources.

Public Exploit Available: Unknown

Given the potential for privilege escalation and the high CVSS severity rating, administrators should prioritize updating their Statamic CMS instances to the patched versions. Failure to apply these updates leaves the administrative layer of the CMS vulnerable to session hijacking and unauthorized administrative actions initiated by lower-privileged accounts.