CVE-2020-9322

CVE-2020-9322 is a critical vulnerability affecting Statamic Core versions prior to 2.11.8, primarily involving Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) on the /users endpoint. This flaw allows an attacker to add an administrator user through CSRF, and also enables stored XSS via JavaScript payloads in usernames during registration, or reflected XSS via the /users PATH_INFO. With a CVSS score of 8.8 (High), the vulnerability is easily exploitable over the network with low privileges and no user interaction, potentially leading to full compromise of confidentiality, integrity, and availability. While no public exploit code (Metasploit, Nuclei, ExploitDB) or active exploitation has been observed, and community discussion is minimal, its high severity warrants immediate patching.