CVE-2026-33883
Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag
概要
Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, the user:reset_password_form tag could render user-input directly into HTML without escaping, allowing an attacker to craft a URL that executes arbitrary JavaScript in the victim's browser. This has been fixed in 5.73.16 and 6.7.2.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov