- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 44 · 1 critical, 14 high, 25 medium, 3 low
- Registry
- Packagist
Advisories 44
- CVE-2026-71435Medium 6.1
Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template
Affected: fixed in 5.74.3; from 6.0.0, fixed in 6.24.2.
- CVE-2026-71434Medium 5.3
Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types
Affected: fixed in 5.74.3; from 6.0.0, fixed in 6.24.2.
- CVE-2026-64662Medium 6.5
Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries
Affected: fixed in 5.74.1; from 6.0.0, fixed in 6.24.0.
- CVE-2026-64663Medium 6.5
Statamic: Unsafe method invocation via Antlers template resolution allows data destruction
Affected: fixed in 5.74.1; from 6.0.0, fixed in 6.24.0.
- CVE-2026-64665High 8.1
Statamic: Account takeover via OAuth email matching without email-verification check
Affected: fixed in 5.74.1; from 6.0.0, fixed in 6.24.0.
- CVE-2026-64664Medium 4.3
Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence
Affected: fixed in 5.74.1; from 6.0.0, fixed in 6.24.0.
- CVE-2026-71293Medium 6.2
Statamic CMS Unguarded Exposure of 2FA Recovery Codes via Antlers current_user Variable
Affected: from 6.0.0-alpha.1, through 6.30.0.
- CVE-2026-54243Medium 6.1
Statamic: CSV formula injection in form submission exports
Affected: from 6.0.0, fixed in 6.20.1; fixed in 5.73.24.
- CVE-2026-54242Medium 4.9
Statamic: Server-Side Request Forgery via Glide (DNS rebinding)
Affected: fixed in 5.73.24; from 6.0.0, fixed in 6.20.1.
- CVE-2026-54244Low 3.5
Statamic: Incorrect authorization lets view-only users submit Live Preview content reserved for editors
Affected: fixed in 5.74.0; from 6.0.0, fixed in 6.20.3.
- CVE-2026-49288Medium 4.3
Statamic CMS missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources
Affected: fixed in 5.73.23; from 6.0.0, fixed in 6.20.0.
- CVE-2026-49287High 7.4
Statamic CMS vulnerable to unsafe method invocation via collection sorting allows data destruction
Affected: fixed in 5.73.23; from 6.0.0, fixed in 6.20.0.
- CVE-2026-45660Medium 5.4
Statamic: Server-Side Request Forgery via Glide
Affected: fixed in 5.73.22; from 6.0.0-alpha.1, fixed in 6.18.1.
- CVE-2026-44306Medium 5.3
Statamic: Email enumeration via forgot password endpoint
Affected: fixed in 5.73.21; from 6.0.0, fixed in 6.15.0.
- CVE-2026-41175High 8.1
Statamic: Unsafe method invocation via query value resolution allows data destruction
Affected: fixed in 5.73.20; from 6.0.0-alpha.1, fixed in 6.13.0.
Show all 44 advisoriesShow fewer advisories
- CVE-2026-33887Medium 5.4
Statamic allows unauthorized content access through missing authorization in its revision controllers
Affected: fixed in 5.73.16; from 6.0.0-alpha.1, fixed in 6.7.2.
- CVE-2026-33886Medium 6.5
Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields
Affected: from 5.73.12, fixed in 5.73.16; from 6.5.0, fixed in 6.7.2.
- CVE-2026-33885Medium 6.1
Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential
Affected: fixed in 5.73.16; from 6.0.0.alpha.1, fixed in 6.7.2.
- CVE-2026-33884Medium 4.3
Statamic's live preview token bypasses content protection for unrelated entries
Affected: fixed in 5.73.16; from 6.0.0-alpha.1, fixed in 6.7.2.
- CVE-2026-33883Medium 6.1
Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag
Affected: fixed in 5.73.16; from 6.0.0-alpha.1, fixed in 6.7.2.
- CVE-2026-33882Medium 6.5
Statamic's Markdown preview endpoint exposes sensitive user data
Affected: fixed in 5.73.16; from 6.0.0-alpha.1, fixed in 6.7.2.
- CVE-2026-33177Medium 4.3
Statamic is missing authorization check on taxonomy term creation via fieldtype
Affected: from 6.0.0-alpha.1, fixed in 6.7.0; fixed in 5.73.14.
- CVE-2026-33172High 8.7
Statamic has Stored XSS via SVG Sanitization Bypass
Affected: from 6.0.0-alpha.1, fixed in 6.7.0; fixed in 5.73.14.
- CVE-2026-33171Medium 4.3
Statamic has a path traversal in file dictionary fieldtype
Affected: from 6.0.0-alpha.1, fixed in 6.7.0; fixed in 5.73.14.
- CVE-2026-32612Medium 5.4
Statamic: privilege escalation via stored cross-site scripting
Affected: from 6.0.0, fixed in 6.6.2.
- CVE-2026-28426High 8.7
Statamic vulnerable to privilege escalation via stored cross-site scripting
Affected: fixed in 5.73.11; from 6.0.0-alpha.1, fixed in 6.4.0.
- CVE-2026-28425High 8.0
Statamic vulnerable to remote code execution via Antlers-enabled control panel inputs
Affected: fixed in 5.73.16; from 6.0.0-alpha.1, fixed in 6.7.2.
- CVE-2026-28424Medium 6.5
Statamic's missing authorization allows access to email addresses
Affected: fixed in 5.73.11; from 6.0.0-alpha.1, fixed in 6.4.0.
- CVE-2026-28423Medium 6.8
Statamic Vulnerable to Server-Side Request Forgery via Glide
Affected: fixed in 5.73.11; from 6.0.0-alpha.1, fixed in 6.4.0.
- CVE-2026-27939High 8.8
Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass
Affected: from 6.0.0, fixed in 6.4.0.
- CVE-2026-27593Critical 9.3
Statamic is vulnerable to account takeover via password reset link injection
Affected: fixed in 5.73.10; from 6.0.0-alpha.1, fixed in 6.7.1.
- CVE-2026-27196High 8.1
Statamic affected by privilege escalation via stored Cross-site Scripting
Affected: from 6.0.0-alpha.1, fixed in 6.3.2; fixed in 5.73.9.
- CVE-2026-25759High 8.7
Statmatic affected by privilege escalation via stored cross-site scripting
Affected: from 6.0.0, fixed in 6.2.3.
- CVE-2026-25633Medium 4.3
Statamic's missing authorization allows access to assets
Affected: fixed in 5.73.6; from 6.0.0-alpha.1, fixed in 6.2.5.
- CVE-2025-64112High 8.0
Statmatic vulnerable to Stored Cross-Site Scripting
Affected: fixed in 5.22.1.
- CVE-2024-52600Medium 5.3
Statamic CMS has Path Traversal in Asset Upload
Affected: fixed in 5.17.0.
- CVE-2024-36119Low 1.8
Password confirmation stored in plain text via registration form in statamic/cms
Affected: from 5.3.0, fixed in 5.6.2.
- CVE-2024-24570High 8.2
Statamic account takeover via XSS and password reset link
Affected: from 4.00, fixed in 4.46.0; fixed in 3.4.17.
- CVE-2023-48701High 7.5
Statamic CMS vulnerable to Cross-site Scripting via uploaded assets
Affected: fixed in 3.4.15; from 4.0.0, fixed in 4.36.0.
- CVE-2023-48217High 8.8
Remote code execution via form uploads in statamic/cms
Affected: from 4.0.0, fixed in 4.34.0; fixed in 3.4.14.
- CVE-2023-47129High 8.4
Statamic CMS remote code execution via front-end form uploads
Affected: from 4.0.0, fixed in 4.33.0; fixed in 3.4.13.
- CVE-2023-36828Medium 5.5
Statamic's Antlers sanitizer cannot effectively sanitize malicious SVG
Affected: fixed in 4.10.0.
- CVE-2022-24784Low 3.7
Discoverability of user password hash in Statamic CMS
Affected: fixed in 3.2.39; from 3.3.0, fixed in 3.3.2.
- CVE-2017-11422Unrated
Statamic framework before 2.6.0 does not correctly check a session's permissions when the methods from a user's class are called.
Affected: fixed in 2.6.0.