CVE-2026-33883
Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag
Summary
Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag
Original description
The description as published by the source.
Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, the user:reset_password_form tag could render user-input directly into HTML without escaping, allowing an attacker to craft a URL that executes arbitrary JavaScript in the victim's browser. This has been fixed in 5.73.16 and 6.7.2.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov