Statamic has Stored XSS via SVG Sanitization Bypass

The impact of this XSS vulnerability is significant, particularly within environments where asset uploads are frequently handled by authenticated users. An attacker could leverage this flaw to inject malicious JavaScript into SVG assets, which would then execute in the browsers of users viewing those assets. This could lead to a variety of attacks, including session hijacking, defacement of the website, redirection to malicious sites, and theft of sensitive user data. The attacker's ability to bypass SVG sanitization highlights a critical failure in the CMS's security controls, making it easier to inject harmful code. Given the widespread use of CMS platforms and the potential for large-scale impact, this vulnerability warrants immediate attention.

Organizations using Statamic CMS with asset upload functionality enabled are at risk. This includes websites with user-generated content, e-commerce platforms allowing users to upload product images, and any site where authenticated users can upload SVG assets. Specifically, those running Statamic CMS versions prior to 6.7.0 are vulnerable.

• php / server:

find /var/www/statamic/assets -name '*.svg' -print0 | xargs -0 grep -i '<script' |

• php / server:

journalctl -u php-fpm -f | grep -i "SVG sanitization bypass"

• generic web: Check asset directories for suspicious SVG files with obfuscated JavaScript code. • generic web: Review access logs for requests containing SVG files with unusual parameters or user agents.

1. 2026-03-18Disclosure

   disclosure

1. Reservado2026-03-17
2. Publicada2026-03-18
3. Modificada2026-03-25
4. EPSS atualizado2026-03-28

The primary mitigation for CVE-2026-33172 is to upgrade Statamic CMS to version 6.7.0 or later, which includes the necessary fixes to prevent SVG sanitization bypass. If an immediate upgrade is not feasible due to compatibility concerns or breaking changes, consider implementing temporary workarounds. These may include restricting SVG uploads entirely, implementing stricter input validation on uploaded files, or utilizing a Web Application Firewall (WAF) with rules to detect and block malicious SVG content. Review existing asset upload processes and ensure proper validation and sanitization of all uploaded files. After upgrading, confirm the fix by attempting to upload a crafted SVG file containing a simple JavaScript payload (e.g., an alert box) and verifying that the payload is not executed.

Última atualização

6.20.0recentemente