A stored XSS vulnerability in the Statamic CMS allows authenticated users to execute arbitrary JavaScript, posing a significant risk to administrative sessions and data integrity.

This is a stored cross-site scripting (CWE-79) vulnerability occurring during the reupload of SVG assets. An authenticated user with existing asset upload privileges can bypass sanitization filters to inject malicious scripts that execute in the context of other users viewing the asset.

The vulnerability carries a CVSS score of 8.7, reflecting its high impact on confidentiality and integrity. Successful exploitation could lead to unauthorized actions performed on behalf of administrators, potential session hijacking, or the theft of sensitive data from the content management environment.

Immediate Action: Update Statamic CMS to version 6.7.0 or 5.73.14 immediately to apply the necessary SVG sanitization patches.

Proactive Monitoring: Monitor access logs for unusual SVG upload patterns or suspicious activity originating from administrative user accounts.

Compensating Controls: Restrict asset upload permissions to trusted users only and implement a strict Content Security Policy (CSP) to limit the execution of unauthorized scripts in the browser.

Public Exploit Available: Unknown.

Given the high CVSS score and the potential for cross-site scripting to compromise administrative accounts, this vulnerability should be prioritized for remediation. Administrators must verify their current version of Statamic and apply the provided security updates to eliminate the sanitization bypass flaw.