Vulnerabilities

TI-2026-50055 CVE-2026-71435 · GHSA-vx89-p3j7-8xqc

Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template

LOW 27

Statamic is a Laravel and Git powered content management system (CMS).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00338 Published 2026-08-06 Fixed in 5.74.3, 6.24.2 CWE-79

TI-2026-50054 CVE-2026-71434 · GHSA-qhr7-v3xp-vw9m

Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types

LOW 30

Statamic is a Laravel and Git powered content management system (CMS).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00412 Published 2026-08-06 Fixed in 5.74.3, 6.24.2 CWE-434

TI-2026-46218 CVE-2026-64662 · GHSA-qh8c-7588-qfrv

Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries

LOW 29

Statamic is a Laravel and Git powered content management system (CMS).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00415 Published 2026-08-06 Fixed in 5.74.1, 6.24.0 CWE-639

TI-2026-46219 CVE-2026-64663 · GHSA-j2vp-f2pv-5rj4

Statamic: Unsafe method invocation via Antlers template resolution allows data destruction

LOW 29

Statamic is a Laravel and Git powered content management system (CMS).

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00396 Published 2026-08-06 Fixed in 5.74.1, 6.24.0 CWE-470

TI-2026-46221 CVE-2026-64665 · GHSA-93qh-5269-9wcf

Statamic: Account takeover via OAuth email matching without email-verification check

LOW 38

Statamic is a Laravel and Git powered content management system (CMS).

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.0054 Published 2026-08-06 Fixed in 5.74.1, 6.24.0 CWE-287

TI-2026-46220 CVE-2026-64664 · GHSA-225x-3jhx-wh4q

Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence

LOW 20

Statamic is a Laravel and Git powered content management system (CMS).

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00342 Published 2026-08-06 Fixed in 6.24.0, 5.74.1 CWE-200

TI-2026-49960 CVE-2026-71293 · GHSA-jppw-r5j3-xf7x

Statamic CMS Unguarded Exposure of 2FA Recovery Codes via Antlers current_user Variable

LOW 28

Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the handle that returns the user's raw two-factor recovery codes with no access restriction.

CVSS 3.1MEDIUM 6.2 Network High privileges User interaction EPSS 0.00372 Published 2026-08-05 No fix listed CWE-200

TI-2026-39145 CVE-2026-54243 · GHSA-h77m-qrj7-jxcw

Statamic: CSV formula injection in form submission exports

LOW 27

Statamic is a Laravel and Git powered content management system (CMS).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00338 Published 2026-07-17 Fixed in 5.73.24, 6.20.1 CWE-1236

TI-2026-39144 CVE-2026-54242 · GHSA-v5c4-wcpj-x73m

Statamic: Server-Side Request Forgery via Glide (DNS rebinding)

LOW 22

Statamic is a Laravel and Git powered content management system (CMS).

CVSS 3.1MEDIUM 4.9 Network Low privileges No interaction EPSS 0.00226 Published 2026-07-17 Fixed in 5.73.24, 6.20.1 CWE-367

TI-2026-39146 CVE-2026-54244 · GHSA-7mqq-4v55-88gh

Statamic: Incorrect authorization lets view-only users submit Live Preview content reserved for editors

LOW 17

Statamic is a Laravel and Git powered content management system (CMS).

CVSS 3.1LOW 3.5 Network Low privileges User interaction EPSS 0.00303 Published 2026-07-17 Fixed in 5.74.0, 6.20.3 CWE-863

TI-2026-36474 CVE-2026-49288 · GHSA-2497-6pwj-pwg7

Statamic CMS missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources

LOW 20

Statamic is a Laravel and Git powered content management system (CMS).

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0027 Published 2026-06-19 Fixed in 5.73.23, 6.20.0 CWE-200

TI-2026-36473 CVE-2026-49287 · GHSA-m92m-r54r-x8r2

Statamic CMS vulnerable to unsafe method invocation via collection sorting allows data destruction

LOW 33

Statamic is a Laravel and Git powered content management system (CMS).

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00457 Published 2026-06-19 Fixed in 5.73.23, 6.20.0 CWE-470

TI-2026-33402 CVE-2026-45660 · GHSA-pf9c-ch8r-2958

Statamic: Server-Side Request Forgery via Glide

LOW 23

Statamic is a Laravel and Git powered content management system (CMS).

CVSS 3.1MEDIUM 5.4 Network No auth No interaction EPSS 0.00151 Published 2026-05-29 Fixed in 5.73.22, 6.18.1 CWE-918

TI-2026-32274 CVE-2026-44306 · GHSA-m24v-f7g5-gq67

Statamic: Email enumeration via forgot password endpoint

LOW 29

Statamic is a Laravel and Git powered content management system (CMS).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00206 Published 2026-05-12 Fixed in 5.73.21, 6.15.0 CWE-204

TI-2026-29798 CVE-2026-41175 · GHSA-4jjr-vmv7-wh4w

Statamic: Unsafe method invocation via query value resolution allows data destruction

LOW 35

Statamic is a Laravel and Git powered content management system (CMS).

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00304 Published 2026-04-22 Fixed in 5.73.20, 6.13.0 CWE-470

TI-2026-26245 CVE-2026-33887 · GHSA-4hp7-3wxg-cv9q

Statamic allows unauthorized content access through missing authorization in its revision controllers

LOW 23

Statamic is a Laravel and Git powered content management system (CMS).

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00148 Published 2026-03-27 Fixed in 5.73.16, 6.7.2 CWE-862

TI-2026-26244 CVE-2026-33886 · GHSA-gcqf-5x9f-hq7f

Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields

LOW 28

Statamic is a Laravel and Git powered content management system (CMS).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00232 Published 2026-03-27 Fixed in 5.73.16, 6.7.2 CWE-200

TI-2026-26243 CVE-2026-33885 · GHSA-7f74-7q5w-hj4r

Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential

LOW 26

Statamic is a Laravel and Git powered content management system (CMS).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00183 Published 2026-03-27 Fixed in 5.73.16, 6.7.2 CWE-601

TI-2026-26242 CVE-2026-33884 · GHSA-8vwx-ccf6-5wg2

Statamic's live preview token bypasses content protection for unrelated entries

LOW 19

Statamic is a Laravel and Git powered content management system (CMS).

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00168 Published 2026-03-27 Fixed in 5.73.16, 6.7.2 CWE-863

TI-2026-26241 CVE-2026-33883 · GHSA-3jg4-p23x-p4qx

Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag

LOW 26

Statamic is a Laravel and Git powered content management system (CMS).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00155 Published 2026-03-27 Fixed in 5.73.16, 6.7.2 CWE-79

TI-2026-26240 CVE-2026-33882 · GHSA-cvh3-23vq-w7h4

Statamic's Markdown preview endpoint exposes sensitive user data

LOW 28

Statamic is a Laravel and Git powered content management system (CMS).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00265 Published 2026-03-27 Fixed in 5.73.16, 6.7.2 CWE-20

TI-2026-25607 CVE-2026-33177 · GHSA-wh3h-gvc4-cc2g

Statamic is missing authorization check on taxonomy term creation via fieldtype

LOW 20

Statamic is a Laravel and Git powered content management system (CMS).

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00237 Published 2026-03-20 Fixed in 6.7.0, 5.73.14 CWE-862

TI-2026-25602 CVE-2026-33172 · GHSA-7rcv-55mj-chg7

Statamic has Stored XSS via SVG Sanitization Bypass

MEDIUM 40

Statamic is a Laravel and Git powered content management system (CMS).

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00338 Published 2026-03-20 Fixed in 6.7.0, 5.73.14 CWE-79

TI-2026-25601 CVE-2026-33171 · GHSA-qm7r-wwq7-6f85

Statamic has a path traversal in file dictionary fieldtype

LOW 20

Statamic is a Laravel and Git powered content management system (CMS).

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0037 Published 2026-03-20 Fixed in 6.7.0, 5.73.14 CWE-22

TI-2026-25121 CVE-2026-32612 · GHSA-hcch-w73c-jp4m

Statamic: privilege escalation via stored cross-site scripting

LOW 24

Statamic is a Laravel and Git powered content management system (CMS).

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00261 Published 2026-03-12 Fixed in 6.6.2 CWE-79

Vulnerabilities

Filters