Statamic CMS Reflected Cross-Site Scripting Vulnerability in Password Reset Form Tag

A reflected cross-site scripting vulnerability has been identified in Statamic CMS versions prior to 5.73.16 and 6.7.2. The issue arises in the 'user:reset_password_form' tag, which can render user input directly into HTML without proper escaping. This flaw allows an attacker to create a URL that executes arbitrary JavaScript in the browser of the victim.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious JavaScript that is executed in the context of the user's browser.

Remediation

Users can upgrade to Statamic CMS versions 5.73.16 or 6.7.2 to address this vulnerability.