TI-2024-16191 CVE-2024-24570 · GHSA-vqxq-hvxw-9mv9
Statamic account takeover via XSS and password reset link
Priority HIGH 75
Statamic is a Laravel and Git powered CMS.
statamic
Records46All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high15CVSS 7.0–8.9
Exploited now
statamic records in CISA KEVNo statamic vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
46 records
TI-2023-18622 CVE-2023-36828 · GHSA-6r5g-cq4q-327g
Statamic's Antlers sanitizer cannot effectively sanitize malicious SVG
Priority MEDIUM 58
Statamic is a flat-first, Laravel and Git powered content management system.
TI-2021-20500 CVE-2021-45364 · GHSA-hv3v-c734-65qr
A Code Execution vulnerability exists in Statamic Version through 3.2.26 via…
Priority MEDIUM 46
A Code Execution vulnerability exists in Statamic Version through 3.2.26 via SettingsController.php.
TI-2023-25469 CVE-2023-47129 · GHSA-72hg-5wr5-rmfc
Statamic CMS remote code execution via front-end form uploads
Priority MEDIUM 45
Statmic is a core Laravel content management system Composer package.
TI-2023-26081 CVE-2023-48217 · GHSA-2r53-9295-3m86
Remote code execution via form uploads in statamic/cms
Priority MEDIUM 42
Statamic is a flat-first, Laravel + Git powered CMS designed for building websites.
TI-2026-21980 CVE-2026-27593 · GHSA-jxq9-79vj-rgvw
Statamic is vulnerable to account takeover via password reset link injection
Priority MEDIUM 41
Statmatic is a Laravel and Git powered content management system (CMS).
TI-2026-25602 CVE-2026-33172 · GHSA-7rcv-55mj-chg7
Statamic has Stored XSS via SVG Sanitization Bypass
Priority MEDIUM 40
Statamic is a Laravel and Git powered content management system (CMS).
TI-2026-22283 CVE-2026-27939 · GHSA-rw9x-pxqx-q789
Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass
Priority MEDIUM 40
Statmatic is a Laravel and Git powered content management system (CMS).
TI-2017-08449 CVE-2017-11422 · GHSA-5m64-9hq5-5pf2
Statamic framework before 2.6.0 does not correctly check a session's permissions when the…
Priority MEDIUM 40
Statamic framework before 2.6.0 does not correctly check a session's permissions when the methods from a user's class are called.
TI-2026-22700 CVE-2026-28426 · GHSA-5vrj-wf7v-5wr7
Statamic vulnerable to privilege escalation via stored cross-site scripting
Priority LOW 39
Statmatic is a Laravel and Git powered content management system (CMS).
TI-2026-46221 CVE-2026-64665 · GHSA-93qh-5269-9wcf
Statamic: Account takeover via OAuth email matching without email-verification check
Priority LOW 38
Statamic is a Laravel and Git powered content management system (CMS).
TI-2026-22697 CVE-2026-28423 · GHSA-cwpp-325q-2cvp
Statamic Vulnerable to Server-Side Request Forgery via Glide
Priority LOW 38
Statmatic is a Laravel and Git powered content management system (CMS).
TI-2026-20826 CVE-2026-25759 · GHSA-ff9r-ww9c-43x8
Statmatic affected by privilege escalation via stored cross-site scripting
Priority LOW 38
Statmatic is a Laravel and Git powered content management system (CMS).
TI-2026-22699 CVE-2026-28425 · GHSA-cpv7-q2wx-m8rw
Statamic vulnerable to remote code execution via Antlers-enabled control panel inputs
Priority LOW 37
Statmatic is a Laravel and Git powered content management system (CMS).
TI-2025-39563 CVE-2025-64112 · GHSA-g59r-24g3-h7cm
Statmatic vulnerable to Stored Cross-Site Scripting
Priority LOW 37
Statmatic is a Laravel and Git powered content management system (CMS).
TI-2026-29798 CVE-2026-41175 · GHSA-4jjr-vmv7-wh4w
Statamic: Unsafe method invocation via query value resolution allows data destruction
Priority LOW 35
Statamic is a Laravel and Git powered content management system (CMS).
TI-2026-21633 CVE-2026-27196 · GHSA-8r7r-f4gm-wcpq
Statamic affected by privilege escalation via stored Cross-site Scripting
Priority LOW 35
Statmatic is a Laravel and Git powered content management system (CMS).
TI-2023-26540 CVE-2023-48701 · GHSA-8jjh-j3c2-cjcv
Statamic CMS vulnerable to Cross-site Scripting via uploaded assets
Priority LOW 34
Statamic CMS is a Laravel and Git powered content management system (CMS).
TI-2026-36473 CVE-2026-49287 · GHSA-m92m-r54r-x8r2
Statamic CMS vulnerable to unsafe method invocation via collection sorting allows data destruction
Priority LOW 33
Statamic is a Laravel and Git powered content management system (CMS).
TI-2024-35260 CVE-2024-52600 · GHSA-p7f6-8mcm-fwv3
Statamic CMS has Path Traversal in Asset Upload
Priority LOW 31
Statmatic is a Laravel and Git powered content management system (CMS).
TI-2026-50054 CVE-2026-71434 · GHSA-qhr7-v3xp-vw9m
Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types
Priority LOW 30
Statamic is a Laravel and Git powered content management system (CMS).
TI-2026-46219 CVE-2026-64663 · GHSA-j2vp-f2pv-5rj4
Statamic: Unsafe method invocation via Antlers template resolution allows data destruction
Priority LOW 29
Statamic is a Laravel and Git powered content management system (CMS).
TI-2026-46218 CVE-2026-64662 · GHSA-qh8c-7588-qfrv
Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries
Priority LOW 29
Statamic is a Laravel and Git powered content management system (CMS).
TI-2026-32274 CVE-2026-44306 · GHSA-m24v-f7g5-gq67
Statamic: Email enumeration via forgot password endpoint
Priority LOW 29
Statamic is a Laravel and Git powered content management system (CMS).
TI-2026-49960 CVE-2026-71293 · GHSA-jppw-r5j3-xf7x
Statamic CMS Unguarded Exposure of 2FA Recovery Codes via Antlers current_user Variable
Priority LOW 28
Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the handle that returns the user's raw two-factor recovery codes with no access restriction.