CVE-2023-36828

    Dashboard / Vulnerabilities / CVE-2023-36828

    CVE-2023-36828

    Published: 5 Jul 2023Last Modified: 12 Aug 2026

    Summary: Statamic's Antlers sanitizer cannot effectively sanitize malicious SVG

    Details: Statamic is a flat-first, Laravel and Git powered content management system. Prior to version 4.10.0, the SVG tag does not sanitize malicious SVG. Therefore, an attacker can exploit this vulnerability to perform cross-site scripting attacks using SVG, even when using the `sanitize` function. Version 4.10.0 contains a patch for this issue.

    References: https://github.com/statamic/cms/blob/f806b6b007ddcf066082eef175653c5beaa96d60/src/Http/Controllers/CP/Fieldtypes/FilesFieldtypeController.php#L15, https://github.com/statamic/cms/blob/f806b6b007ddcf066082eef175653c5beaa96d60/src/Tags/Svg.php#L36-L40, https://github.com/statamic/cms/releases/tag/v4.10.0, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36828.json, https://github.com/statamic/cms/security/advisories/GHSA-6r5g-cq4q-327g, https://nvd.nist.gov/vuln/detail/CVE-2023-36828, https://github.com/statamic/cms/commit/c714893ad92de6e5ede17b501003441af505b30d, https://github.com/statamic/cms/pull/8408

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -5261b3ba40707d013eeeedf6e8e9b225b22b5f8f

    Affected versions

    v4.9.2
    v4.9.1
    v4.9.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-36828 | CVE-DB