Threats affecting pkg:composer/statamic/cms

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, low-privileged Control Panel users could create taxonomy terms by submitting requests to the field action processing endpoint with attacker-controlled field definitions. This bypasses the authorization checks enforced on the standard taxonomy term creation endpoint. This has been fixed in 5.73.14 and 6.7.0.

Statamic CMS versions up to 5.22.0 contain stored cross-site scripting (XSS) vulnerabilities in Collections and Taxonomies that allow authenticated users with content creation permissions to inject malicious JavaScript. When a super admin views the compromised content, the attacker can exploit this to take over the superadmin account by changing the password or email address. The issue is fixed in version 5.22.1.