statamic

Records46All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical3CVSS 9.0–10.0

CVSS high15CVSS 7.0–8.9

Exploited now

statamic records in CISA KEV

No statamic vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Statamic 29 records HIGH

Records

29 records in Statamic · all components

TI-2024-16191 CVE-2024-24570 · GHSA-vqxq-hvxw-9mv9

Statamic account takeover via XSS and password reset link

HIGH 75

Statamic is a Laravel and Git powered CMS.

CVSS 3.1HIGH 8.2 Network No auth User interaction EPSS 0.00734 Published 2024-02-01 Fixed in 3.4.17, 4.46.0 CWE-79

TI-2023-18622 CVE-2023-36828 · GHSA-6r5g-cq4q-327g

Statamic's Antlers sanitizer cannot effectively sanitize malicious SVG

MEDIUM 58

Statamic is a flat-first, Laravel and Git powered content management system.

CVSS 3.1MEDIUM 5.5 Network Low privileges User interaction EPSS 0.00655 Published 2023-07-05 Fixed in 4.10.0 CWE-79

TI-2021-20500 CVE-2021-45364 · GHSA-hv3v-c734-65qr

A Code Execution vulnerability exists in Statamic Version through 3.2.26 via…

MEDIUM 46

A Code Execution vulnerability exists in Statamic Version through 3.2.26 via SettingsController.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01724 Published 2022-02-10 No fix listed

TI-2023-25469 CVE-2023-47129 · GHSA-72hg-5wr5-rmfc

Statamic CMS remote code execution via front-end form uploads

MEDIUM 45

Statmic is a core Laravel content management system Composer package.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01121 Published 2023-11-10 Fixed in 3.4.13, 4.33.0 CWE-434

TI-2023-26081 CVE-2023-48217 · GHSA-2r53-9295-3m86

Remote code execution via form uploads in statamic/cms

MEDIUM 42

Statamic is a flat-first, Laravel + Git powered CMS designed for building websites.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01104 Published 2023-11-14 Fixed in 4.34.0, 3.4.14 CWE-94

TI-2026-21980 CVE-2026-27593 · GHSA-jxq9-79vj-rgvw

Statamic is vulnerable to account takeover via password reset link injection

MEDIUM 41

Statmatic is a Laravel and Git powered content management system (CMS).

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.0052 Published 2026-02-24 Fixed in 5.73.10, 6.3.3 +1 CWE-640

TI-2026-25602 CVE-2026-33172 · GHSA-7rcv-55mj-chg7

Statamic has Stored XSS via SVG Sanitization Bypass

MEDIUM 40

Statamic is a Laravel and Git powered content management system (CMS).

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00338 Published 2026-03-20 Fixed in 6.7.0, 5.73.14 CWE-79

TI-2026-22283 CVE-2026-27939 · GHSA-rw9x-pxqx-q789

Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass

MEDIUM 40

Statmatic is a Laravel and Git powered content management system (CMS).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00426 Published 2026-02-27 Fixed in 6.4.0 CWE-287

TI-2017-08449 CVE-2017-11422 · GHSA-5m64-9hq5-5pf2

Statamic framework before 2.6.0 does not correctly check a session's permissions when the…

MEDIUM 40

Statamic framework before 2.6.0 does not correctly check a session's permissions when the methods from a user's class are called.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00867 Published 2017-07-24 Fixed in 2.6.0 CWE-732

TI-2026-22700 CVE-2026-28426 · GHSA-5vrj-wf7v-5wr7

Statamic vulnerable to privilege escalation via stored cross-site scripting

LOW 39

Statmatic is a Laravel and Git powered content management system (CMS).

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00293 Published 2026-02-27 Fixed in 5.73.11, 6.4.0 CWE-79

TI-2026-22697 CVE-2026-28423 · GHSA-cwpp-325q-2cvp

Statamic Vulnerable to Server-Side Request Forgery via Glide

LOW 38

Statmatic is a Laravel and Git powered content management system (CMS).

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00426 Published 2026-02-27 Fixed in 5.73.11, 6.4.0 CWE-918

TI-2026-20826 CVE-2026-25759 · GHSA-ff9r-ww9c-43x8

Statmatic affected by privilege escalation via stored cross-site scripting

LOW 38

Statmatic is a Laravel and Git powered content management system (CMS).

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00333 Published 2026-02-11 Fixed in 6.2.3 CWE-79

TI-2026-22699 CVE-2026-28425 · GHSA-cpv7-q2wx-m8rw

Statamic vulnerable to remote code execution via Antlers-enabled control panel inputs

LOW 37

Statmatic is a Laravel and Git powered content management system (CMS).

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.00499 Published 2026-02-27 Fixed in 5.73.16, 6.7.2 CWE-94

TI-2026-29798 CVE-2026-41175 · GHSA-4jjr-vmv7-wh4w

Statamic: Unsafe method invocation via query value resolution allows data destruction

LOW 35

Statamic is a Laravel and Git powered content management system (CMS).

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00304 Published 2026-04-22 Fixed in 5.73.20, 6.13.0 CWE-470

TI-2026-21633 CVE-2026-27196 · GHSA-8r7r-f4gm-wcpq

Statamic affected by privilege escalation via stored Cross-site Scripting

LOW 35

Statmatic is a Laravel and Git powered content management system (CMS).

CVSS 3.1HIGH 8.1 Network High privileges User interaction EPSS 0.00323 Published 2026-02-21 Fixed in 6.3.2, 5.73.9 CWE-79

TI-2023-26540 CVE-2023-48701 · GHSA-8jjh-j3c2-cjcv

Statamic CMS vulnerable to Cross-site Scripting via uploaded assets

LOW 34

Statamic CMS is a Laravel and Git powered content management system (CMS).

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.007 Published 2023-11-21 Fixed in 3.4.15, 4.36.0 CWE-79

TI-2026-26244 CVE-2026-33886 · GHSA-gcqf-5x9f-hq7f

Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields

LOW 28

Statamic is a Laravel and Git powered content management system (CMS).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00232 Published 2026-03-27 Fixed in 5.73.16, 6.7.2 CWE-200

TI-2026-26240 CVE-2026-33882 · GHSA-cvh3-23vq-w7h4

Statamic's Markdown preview endpoint exposes sensitive user data

LOW 28

Statamic is a Laravel and Git powered content management system (CMS).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00265 Published 2026-03-27 Fixed in 5.73.16, 6.7.2 CWE-20

TI-2026-22698 CVE-2026-28424 · GHSA-w878-f8c6-7r63

Statamic's missing authorization allows access to email addresses

LOW 28

Statmatic is a Laravel and Git powered content management system (CMS).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00268 Published 2026-02-27 Fixed in 5.73.11, 6.4.0 CWE-862

TI-2026-26243 CVE-2026-33885 · GHSA-7f74-7q5w-hj4r

Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential

LOW 26

Statamic is a Laravel and Git powered content management system (CMS).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00183 Published 2026-03-27 Fixed in 5.73.16, 6.7.2 CWE-601

TI-2026-26241 CVE-2026-33883 · GHSA-3jg4-p23x-p4qx

Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag

LOW 26

Statamic is a Laravel and Git powered content management system (CMS).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00155 Published 2026-03-27 Fixed in 5.73.16, 6.7.2 CWE-79

TI-2026-25121 CVE-2026-32612 · GHSA-hcch-w73c-jp4m

Statamic: privilege escalation via stored cross-site scripting

LOW 24

Statamic is a Laravel and Git powered content management system (CMS).

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00261 Published 2026-03-12 Fixed in 6.6.2 CWE-79

TI-2026-26245 CVE-2026-33887 · GHSA-4hp7-3wxg-cv9q

Statamic allows unauthorized content access through missing authorization in its revision controllers

LOW 23

Statamic is a Laravel and Git powered content management system (CMS).

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00148 Published 2026-03-27 Fixed in 5.73.16, 6.7.2 CWE-862

TI-2018-13892 CVE-2018-19598 · GHSA-5hqq-vj6p-3gqf

Statamic 2.10.3 allows XSS via First Name or Last Name to the /users URI in an 'Add new user' request.

LOW 23

Statamic 2.10.3 allows XSS via First Name or Last Name to the /users URI in an 'Add new user' request.

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00559 Published 2018-12-19 No fix listed CWE-79

TI-2026-25607 CVE-2026-33177 · GHSA-wh3h-gvc4-cc2g

Statamic is missing authorization check on taxonomy term creation via fieldtype

LOW 20

Statamic is a Laravel and Git powered content management system (CMS).

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00237 Published 2026-03-20 Fixed in 6.7.0, 5.73.14 CWE-862

Open these records in search →