Vulnerabilities

TI-2026-29798 CVE-2026-41175 · GHSA-4jjr-vmv7-wh4w

Statamic: Unsafe method invocation via query value resolution allows data destruction

LOW 35

Statamic is a Laravel and Git powered content management system (CMS).

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00304 Published 2026-04-22 Fixed in 5.73.20, 6.13.0 CWE-470

TI-2026-26245 CVE-2026-33887 · GHSA-4hp7-3wxg-cv9q

Statamic allows unauthorized content access through missing authorization in its revision controllers

LOW 23

Statamic is a Laravel and Git powered content management system (CMS).

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00148 Published 2026-03-27 Fixed in 5.73.16, 6.7.2 CWE-862

TI-2026-26244 CVE-2026-33886 · GHSA-gcqf-5x9f-hq7f

Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields

LOW 28

Statamic is a Laravel and Git powered content management system (CMS).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00232 Published 2026-03-27 Fixed in 5.73.16, 6.7.2 CWE-200

TI-2026-26243 CVE-2026-33885 · GHSA-7f74-7q5w-hj4r

Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential

LOW 26

Statamic is a Laravel and Git powered content management system (CMS).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00183 Published 2026-03-27 Fixed in 5.73.16, 6.7.2 CWE-601

TI-2026-26242 CVE-2026-33884 · GHSA-8vwx-ccf6-5wg2

Statamic's live preview token bypasses content protection for unrelated entries

LOW 19

Statamic is a Laravel and Git powered content management system (CMS).

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00168 Published 2026-03-27 Fixed in 5.73.16, 6.7.2 CWE-863

TI-2026-26241 CVE-2026-33883 · GHSA-3jg4-p23x-p4qx

Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag

LOW 26

Statamic is a Laravel and Git powered content management system (CMS).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00155 Published 2026-03-27 Fixed in 5.73.16, 6.7.2 CWE-79

TI-2026-26240 CVE-2026-33882 · GHSA-cvh3-23vq-w7h4

Statamic's Markdown preview endpoint exposes sensitive user data

LOW 28

Statamic is a Laravel and Git powered content management system (CMS).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00265 Published 2026-03-27 Fixed in 5.73.16, 6.7.2 CWE-20

TI-2026-25607 CVE-2026-33177 · GHSA-wh3h-gvc4-cc2g

Statamic is missing authorization check on taxonomy term creation via fieldtype

LOW 20

Statamic is a Laravel and Git powered content management system (CMS).

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00237 Published 2026-03-20 Fixed in 6.7.0, 5.73.14 CWE-862

TI-2026-25602 CVE-2026-33172 · GHSA-7rcv-55mj-chg7

Statamic has Stored XSS via SVG Sanitization Bypass

MEDIUM 40

Statamic is a Laravel and Git powered content management system (CMS).

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00338 Published 2026-03-20 Fixed in 6.7.0, 5.73.14 CWE-79

TI-2026-25601 CVE-2026-33171 · GHSA-qm7r-wwq7-6f85

Statamic has a path traversal in file dictionary fieldtype

LOW 20

Statamic is a Laravel and Git powered content management system (CMS).

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0037 Published 2026-03-20 Fixed in 6.7.0, 5.73.14 CWE-22

TI-2026-25121 CVE-2026-32612 · GHSA-hcch-w73c-jp4m

Statamic: privilege escalation via stored cross-site scripting

LOW 24

Statamic is a Laravel and Git powered content management system (CMS).

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00261 Published 2026-03-12 Fixed in 6.6.2 CWE-79

TI-2026-22700 CVE-2026-28426 · GHSA-5vrj-wf7v-5wr7

Statamic vulnerable to privilege escalation via stored cross-site scripting

LOW 39

Statmatic is a Laravel and Git powered content management system (CMS).

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00293 Published 2026-02-27 Fixed in 5.73.11, 6.4.0 CWE-79

TI-2026-22699 CVE-2026-28425 · GHSA-cpv7-q2wx-m8rw

Statamic vulnerable to remote code execution via Antlers-enabled control panel inputs

LOW 37

Statmatic is a Laravel and Git powered content management system (CMS).

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.00499 Published 2026-02-27 Fixed in 5.73.16, 6.7.2 CWE-94

TI-2026-22698 CVE-2026-28424 · GHSA-w878-f8c6-7r63

Statamic's missing authorization allows access to email addresses

LOW 28

Statmatic is a Laravel and Git powered content management system (CMS).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00268 Published 2026-02-27 Fixed in 5.73.11, 6.4.0 CWE-862

TI-2026-22697 CVE-2026-28423 · GHSA-cwpp-325q-2cvp

Statamic Vulnerable to Server-Side Request Forgery via Glide

LOW 38

Statmatic is a Laravel and Git powered content management system (CMS).

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00426 Published 2026-02-27 Fixed in 5.73.11, 6.4.0 CWE-918

TI-2026-22283 CVE-2026-27939 · GHSA-rw9x-pxqx-q789

Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass

MEDIUM 40

Statmatic is a Laravel and Git powered content management system (CMS).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00426 Published 2026-02-27 Fixed in 6.4.0 CWE-287

TI-2026-21980 CVE-2026-27593 · GHSA-jxq9-79vj-rgvw

Statamic is vulnerable to account takeover via password reset link injection

MEDIUM 41

Statmatic is a Laravel and Git powered content management system (CMS).

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.0052 Published 2026-02-24 Fixed in 5.73.10, 6.3.3 +1 CWE-640

TI-2026-21633 CVE-2026-27196 · GHSA-8r7r-f4gm-wcpq

Statamic affected by privilege escalation via stored Cross-site Scripting

LOW 35

Statmatic is a Laravel and Git powered content management system (CMS).

CVSS 3.1HIGH 8.1 Network High privileges User interaction EPSS 0.00323 Published 2026-02-21 Fixed in 6.3.2, 5.73.9 CWE-79

TI-2026-20826 CVE-2026-25759 · GHSA-ff9r-ww9c-43x8

Statmatic affected by privilege escalation via stored cross-site scripting

LOW 38

Statmatic is a Laravel and Git powered content management system (CMS).

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00333 Published 2026-02-11 Fixed in 6.2.3 CWE-79

TI-2026-20733 CVE-2026-25633 · GHSA-gwmx-9gcj-332h

Statamic's missing authorization allows access to assets

LOW 20

Statamic is a, Laravel + Git powered CMS designed for building websites.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00317 Published 2026-02-11 Fixed in 5.73.6, 6.2.5 CWE-862

TI-2024-16191 CVE-2024-24570 · GHSA-vqxq-hvxw-9mv9

Statamic account takeover via XSS and password reset link

HIGH 75

Statamic is a Laravel and Git powered CMS.

CVSS 3.1HIGH 8.2 Network No auth User interaction EPSS 0.00734 Published 2024-02-01 Fixed in 3.4.17, 4.46.0 CWE-79

TI-2023-26540 CVE-2023-48701 · GHSA-8jjh-j3c2-cjcv

Statamic CMS vulnerable to Cross-site Scripting via uploaded assets

LOW 34

Statamic CMS is a Laravel and Git powered content management system (CMS).

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.007 Published 2023-11-21 Fixed in 3.4.15, 4.36.0 CWE-79

TI-2023-26081 CVE-2023-48217 · GHSA-2r53-9295-3m86

Remote code execution via form uploads in statamic/cms

MEDIUM 42

Statamic is a flat-first, Laravel + Git powered CMS designed for building websites.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01104 Published 2023-11-14 Fixed in 4.34.0, 3.4.14 CWE-94

TI-2023-25469 CVE-2023-47129 · GHSA-72hg-5wr5-rmfc

Statamic CMS remote code execution via front-end form uploads

MEDIUM 45

Statmic is a core Laravel content management system Composer package.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01121 Published 2023-11-10 Fixed in 3.4.13, 4.33.0 CWE-434

TI-2023-18622 CVE-2023-36828 · GHSA-6r5g-cq4q-327g

Statamic's Antlers sanitizer cannot effectively sanitize malicious SVG

MEDIUM 58

Statamic is a flat-first, Laravel and Git powered content management system.

CVSS 3.1MEDIUM 5.5 Network Low privileges User interaction EPSS 0.00655 Published 2023-07-05 Fixed in 4.10.0 CWE-79

Vulnerabilities

Filters