Executive brief
Statamic Vulnerable to Superadmin Account Takeover via Stored Cross-Site Scripting and Lack of Proper X-CSRF-TOKEN Server-Side Validation
Affected products
- Packagist statamic/cms
Junglewise Threat Intelligence
CVE-2025-64112: Statamic Vulnerable to Superadmin Account Takeover via Stored Cross-Site Scripting and Lack of Proper X-CSRF-TOKEN Server-Side Validation
CVE-2025-64112 · Severity: low · CVSS 3.1 · Published 2025-10-30
Technologies: statamic/cms (Packagist). Vendors: Packagist.
Related threats
- Statamic CMS two-factor recovery code exposure in Antlers templates
- Statamic vulnerable to privilege escalation via stored cross-site scripting
- Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass
- Statamic CMS vulnerable to privilege escalation via stored cross-site scripting
- Statamic CMS has a Path Traversal in Asset Upload