# statamic/cms (Packagist) vulnerabilities 44 known vulnerabilities (1 critical, 14 high, 25 medium, 3 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://packagist.org/packages/statamic/cms ## Advisories (44) ### [CVE-2026-71435](https://cve.now/CVE-2026-71435): Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template - Severity: Medium 6.1 - Published: Aug 6, 2026 - Affected: fixed in 5.74.3; from 6.0.0, fixed in 6.24.2. ### [CVE-2026-71434](https://cve.now/CVE-2026-71434): Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types - Severity: Medium 5.3 - Published: Aug 6, 2026 - Affected: fixed in 5.74.3; from 6.0.0, fixed in 6.24.2. ### [CVE-2026-64662](https://cve.now/CVE-2026-64662): Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries - Severity: Medium 6.5 - Published: Aug 6, 2026 - Affected: fixed in 5.74.1; from 6.0.0, fixed in 6.24.0. ### [CVE-2026-64663](https://cve.now/CVE-2026-64663): Statamic: Unsafe method invocation via Antlers template resolution allows data destruction - Severity: Medium 6.5 - Published: Aug 6, 2026 - Affected: fixed in 5.74.1; from 6.0.0, fixed in 6.24.0. ### [CVE-2026-64665](https://cve.now/CVE-2026-64665): Statamic: Account takeover via OAuth email matching without email-verification check - Severity: High 8.1 - Published: Aug 6, 2026 - Affected: fixed in 5.74.1; from 6.0.0, fixed in 6.24.0. ### [CVE-2026-64664](https://cve.now/CVE-2026-64664): Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence - Severity: Medium 4.3 - Published: Aug 6, 2026 - Affected: fixed in 5.74.1; from 6.0.0, fixed in 6.24.0. ### [CVE-2026-71293](https://cve.now/CVE-2026-71293): Statamic CMS Unguarded Exposure of 2FA Recovery Codes via Antlers current\_user Variable - Severity: Medium 6.2 - Published: Aug 5, 2026 - Affected: from 6.0.0-alpha.1, through 6.30.0. ### [CVE-2026-54243](https://cve.now/CVE-2026-54243): Statamic: CSV formula injection in form submission exports - Severity: Medium 6.1 - Published: Jul 17, 2026 - Affected: from 6.0.0, fixed in 6.20.1; fixed in 5.73.24. ### [CVE-2026-54242](https://cve.now/CVE-2026-54242): Statamic: Server-Side Request Forgery via Glide (DNS rebinding) - Severity: Medium 4.9 - Published: Jul 17, 2026 - Affected: fixed in 5.73.24; from 6.0.0, fixed in 6.20.1. ### [CVE-2026-54244](https://cve.now/CVE-2026-54244): Statamic: Incorrect authorization lets view-only users submit Live Preview content reserved for editors - Severity: Low 3.5 - Published: Jul 17, 2026 - Affected: fixed in 5.74.0; from 6.0.0, fixed in 6.20.3. ### [CVE-2026-49288](https://cve.now/CVE-2026-49288): Statamic CMS missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources - Severity: Medium 4.3 - Published: Jun 19, 2026 - Affected: fixed in 5.73.23; from 6.0.0, fixed in 6.20.0. ### [CVE-2026-49287](https://cve.now/CVE-2026-49287): Statamic CMS vulnerable to unsafe method invocation via collection sorting allows data destruction - Severity: High 7.4 - Published: Jun 19, 2026 - Affected: fixed in 5.73.23; from 6.0.0, fixed in 6.20.0. ### [CVE-2026-45660](https://cve.now/CVE-2026-45660): Statamic: Server-Side Request Forgery via Glide - Severity: Medium 5.4 - Published: May 29, 2026 - Affected: fixed in 5.73.22; from 6.0.0-alpha.1, fixed in 6.18.1. ### [CVE-2026-44306](https://cve.now/CVE-2026-44306): Statamic: Email enumeration via forgot password endpoint - Severity: Medium 5.3 - Published: May 12, 2026 - Affected: fixed in 5.73.21; from 6.0.0, fixed in 6.15.0. ### [CVE-2026-41175](https://cve.now/CVE-2026-41175): Statamic: Unsafe method invocation via query value resolution allows data destruction - Severity: High 8.1 - Published: Apr 22, 2026 - Affected: fixed in 5.73.20; from 6.0.0-alpha.1, fixed in 6.13.0. ### [CVE-2026-33887](https://cve.now/CVE-2026-33887): Statamic allows unauthorized content access through missing authorization in its revision controllers - Severity: Medium 5.4 - Published: Mar 27, 2026 - Affected: fixed in 5.73.16; from 6.0.0-alpha.1, fixed in 6.7.2. ### [CVE-2026-33886](https://cve.now/CVE-2026-33886): Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields - Severity: Medium 6.5 - Published: Mar 27, 2026 - Affected: from 5.73.12, fixed in 5.73.16; from 6.5.0, fixed in 6.7.2. ### [CVE-2026-33885](https://cve.now/CVE-2026-33885): Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential - Severity: Medium 6.1 - Published: Mar 27, 2026 - Affected: fixed in 5.73.16; from 6.0.0.alpha.1, fixed in 6.7.2. ### [CVE-2026-33884](https://cve.now/CVE-2026-33884): Statamic's live preview token bypasses content protection for unrelated entries - Severity: Medium 4.3 - Published: Mar 27, 2026 - Affected: fixed in 5.73.16; from 6.0.0-alpha.1, fixed in 6.7.2. ### [CVE-2026-33883](https://cve.now/CVE-2026-33883): Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag - Severity: Medium 6.1 - Published: Mar 27, 2026 - Affected: fixed in 5.73.16; from 6.0.0-alpha.1, fixed in 6.7.2. ### [CVE-2026-33882](https://cve.now/CVE-2026-33882): Statamic's Markdown preview endpoint exposes sensitive user data - Severity: Medium 6.5 - Published: Mar 27, 2026 - Affected: fixed in 5.73.16; from 6.0.0-alpha.1, fixed in 6.7.2. ### [CVE-2026-33177](https://cve.now/CVE-2026-33177): Statamic is missing authorization check on taxonomy term creation via fieldtype - Severity: Medium 4.3 - Published: Mar 20, 2026 - Affected: from 6.0.0-alpha.1, fixed in 6.7.0; fixed in 5.73.14. ### [CVE-2026-33172](https://cve.now/CVE-2026-33172): Statamic has Stored XSS via SVG Sanitization Bypass - Severity: High 8.7 - Published: Mar 20, 2026 - Affected: from 6.0.0-alpha.1, fixed in 6.7.0; fixed in 5.73.14. ### [CVE-2026-33171](https://cve.now/CVE-2026-33171): Statamic has a path traversal in file dictionary fieldtype - Severity: Medium 4.3 - Published: Mar 20, 2026 - Affected: from 6.0.0-alpha.1, fixed in 6.7.0; fixed in 5.73.14. ### [CVE-2026-32612](https://cve.now/CVE-2026-32612): Statamic: privilege escalation via stored cross-site scripting - Severity: Medium 5.4 - Published: Mar 12, 2026 - Affected: from 6.0.0, fixed in 6.6.2. ### [CVE-2026-28426](https://cve.now/CVE-2026-28426): Statamic vulnerable to privilege escalation via stored cross-site scripting - Severity: High 8.7 - Published: Feb 27, 2026 - Affected: fixed in 5.73.11; from 6.0.0-alpha.1, fixed in 6.4.0. ### [CVE-2026-28425](https://cve.now/CVE-2026-28425): Statamic vulnerable to remote code execution via Antlers-enabled control panel inputs - Severity: High 8.0 - Published: Feb 27, 2026 - Affected: fixed in 5.73.16; from 6.0.0-alpha.1, fixed in 6.7.2. ### [CVE-2026-28424](https://cve.now/CVE-2026-28424): Statamic's missing authorization allows access to email addresses - Severity: Medium 6.5 - Published: Feb 27, 2026 - Affected: fixed in 5.73.11; from 6.0.0-alpha.1, fixed in 6.4.0. ### [CVE-2026-28423](https://cve.now/CVE-2026-28423): Statamic Vulnerable to Server-Side Request Forgery via Glide - Severity: Medium 6.8 - Published: Feb 27, 2026 - Affected: fixed in 5.73.11; from 6.0.0-alpha.1, fixed in 6.4.0. ### [CVE-2026-27939](https://cve.now/CVE-2026-27939): Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass - Severity: High 8.8 - Published: Feb 27, 2026 - Affected: from 6.0.0, fixed in 6.4.0. ### [CVE-2026-27593](https://cve.now/CVE-2026-27593): Statamic is vulnerable to account takeover via password reset link injection - Severity: Critical 9.3 - Published: Feb 24, 2026 - Affected: fixed in 5.73.10; from 6.0.0-alpha.1, fixed in 6.7.1. ### [CVE-2026-27196](https://cve.now/CVE-2026-27196): Statamic affected by privilege escalation via stored Cross-site Scripting - Severity: High 8.1 - Published: Feb 21, 2026 - Affected: from 6.0.0-alpha.1, fixed in 6.3.2; fixed in 5.73.9. ### [CVE-2026-25759](https://cve.now/CVE-2026-25759): Statmatic affected by privilege escalation via stored cross-site scripting - Severity: High 8.7 - Published: Feb 11, 2026 - Affected: from 6.0.0, fixed in 6.2.3. ### [CVE-2026-25633](https://cve.now/CVE-2026-25633): Statamic's missing authorization allows access to assets - Severity: Medium 4.3 - Published: Feb 11, 2026 - Affected: fixed in 5.73.6; from 6.0.0-alpha.1, fixed in 6.2.5. ### [CVE-2025-64112](https://cve.now/CVE-2025-64112): Statmatic vulnerable to Stored Cross-Site Scripting - Severity: High 8.0 - Published: Oct 30, 2025 - Affected: fixed in 5.22.1. ### [CVE-2024-52600](https://cve.now/CVE-2024-52600): Statamic CMS has Path Traversal in Asset Upload - Severity: Medium 5.3 - Published: Nov 19, 2024 - Affected: fixed in 5.17.0. ### [CVE-2024-36119](https://cve.now/CVE-2024-36119): Password confirmation stored in plain text via registration form in statamic/cms - Severity: Low 1.8 - Published: May 30, 2024 - Affected: from 5.3.0, fixed in 5.6.2. ### [CVE-2024-24570](https://cve.now/CVE-2024-24570): Statamic account takeover via XSS and password reset link - Severity: High 8.2 - Published: Feb 1, 2024 - Affected: from 4.00, fixed in 4.46.0; fixed in 3.4.17. ### [CVE-2023-48701](https://cve.now/CVE-2023-48701): Statamic CMS vulnerable to Cross-site Scripting via uploaded assets - Severity: High 7.5 - Published: Nov 21, 2023 - Affected: fixed in 3.4.15; from 4.0.0, fixed in 4.36.0. ### [CVE-2023-48217](https://cve.now/CVE-2023-48217): Remote code execution via form uploads in statamic/cms - Severity: High 8.8 - Published: Nov 14, 2023 - Affected: from 4.0.0, fixed in 4.34.0; fixed in 3.4.14. ### [CVE-2023-47129](https://cve.now/CVE-2023-47129): Statamic CMS remote code execution via front-end form uploads - Severity: High 8.4 - Published: Nov 10, 2023 - Affected: from 4.0.0, fixed in 4.33.0; fixed in 3.4.13. ### [CVE-2023-36828](https://cve.now/CVE-2023-36828): Statamic's Antlers sanitizer cannot effectively sanitize malicious SVG - Severity: Medium 5.5 - Published: Jul 5, 2023 - Affected: fixed in 4.10.0. ### [CVE-2022-24784](https://cve.now/CVE-2022-24784): Discoverability of user password hash in Statamic CMS - Severity: Low 3.7 - Published: Mar 25, 2022 - Affected: fixed in 3.2.39; from 3.3.0, fixed in 3.3.2. ### [CVE-2017-11422](https://cve.now/CVE-2017-11422): Statamic framework before 2.6.0 does not correctly check a session's permissions when the methods from a user's class are called. - Severity: Unrated - Published: Jul 24, 2017 - Affected: fixed in 2.6.0. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/packagist/statamic/cms Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.