Statamic is a Laravel and Git powered content management system (CMS).

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Mar 13, 2026 · NIST NVD

   Detected

   Statamic is a Laravel and Git powered content management system (CMS). Prior to 6.6.2, stored XSS in the control panel color mode preference allows authenticated users with control panel access to inject malicious JavaScript that executes when a higher-privileged user impersonates their account. This has been fixed in 6.6.2.

2. Jun 17, 2026 · NIST NVD

   Updated

   Statamic is a Laravel and Git powered content management system (CMS). Prior to 6.6.2, stored XSS in the control panel color mode preference allows authenticated users with control panel access to inject malicious JavaScript that executes when a higher-privileged user impersonates their account. This has been fixed in 6.6.2.

Affected

• cpe statamic/statamicversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-32612

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-32612

  Statamic is a Laravel and Git powered content management system (CMS). Prior to 6.6.2, stored XSS in the control panel color mode preference allows authenticated users with control panel access to inject malicious JavaScript that executes when a higher-privileged user impersonate

  nvd.nist.gov

References

• Exploit · github.com
• Vendor Advisory · github.com