Statamic CMS Stored Cross-Site Scripting Vulnerability in SVG and Icon Components

A stored cross-site scripting vulnerability has been identified in Statamic CMS versions prior to 5.73.11 and 6.4.0. This issue allows authenticated users with the necessary permissions to inject malicious JavaScript into SVG and icon-related components. The injected script executes when the content is viewed by users with higher privileges.

Impact

Exploitation of this vulnerability allows for privilege escalation through the execution of injected JavaScript, potentially leading to unauthorized actions being performed on behalf of a user with elevated rights.

Remediation

Users can upgrade to Statamic CMS versions 5.73.11 or 6.4.0 to address this vulnerability.