Statamic CMS is vulnerable to a stored cross‑site scripting flaw that lets authenticated users with asset upload rights inject arbitrary JavaScript into SVG files. When a victim views the manipulated SVG, the embedded code executes in the victim’s browser, enabling data theft or session hijacking. This weakness arises from a bypass of the system’s SVG sanitization and is classified as CWE‑79.

The issue affects Statamic CMS versions earlier than 5.73.14 and 6.7.0. Any installation that allows asset uploads for authenticated users is at risk until the patch is applied.

The CVSS base score of 8.7 indicates high severity, yet the EPSS probability is below 1 % and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the attacker first obtain legitimate credentials with upload privileges, after which they can upload a crafted SVG that bypasses sanitization. The impact is limited to users who view the malicious asset, but the potential for wide spread remains if many users consume the file.