Statamic vulnerabilities
43 CVEs and advisories name Statamic as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-71435Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template
- CVE-2026-71434Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types
- CVE-2026-64662Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries
- CVE-2026-64663Statamic: Unsafe method invocation via Antlers template resolution allows data destruction
- CVE-2026-64665Statamic: Account takeover via OAuth email matching without email-verification check
- CVE-2026-64664Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence
- CVE-2026-71293Statamic CMS Unguarded Exposure of 2FA Recovery Codes via Antlers current_user Variable
- CVE-2026-54243Statamic: CSV formula injection in form submission exports
- CVE-2026-54242Statamic: Server-Side Request Forgery via Glide (DNS rebinding)
- CVE-2026-54244Statamic: Incorrect authorization lets view-only users submit Live Preview content reserved for editors
- CVE-2026-49288Statamic CMS missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources
- CVE-2026-49287Statamic CMS vulnerable to unsafe method invocation via collection sorting allows data destruction
- CVE-2026-45660Statamic: Server-Side Request Forgery via Glide
- CVE-2026-44306Statamic: Email enumeration via forgot password endpoint
- CVE-2026-41175Statamic: Unsafe method invocation via query value resolution allows data destruction
- CVE-2026-33887Statamic allows unauthorized content access through missing authorization in its revision controllers
- CVE-2026-33886Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields
- CVE-2026-33885Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential
- CVE-2026-33884Statamic's live preview token bypasses content protection for unrelated entries
- CVE-2026-33883Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag
- CVE-2026-33882Statamic's Markdown preview endpoint exposes sensitive user data
- CVE-2026-33177Statamic is missing authorization check on taxonomy term creation via fieldtype
- CVE-2026-33172Statamic has Stored XSS via SVG Sanitization Bypass
- CVE-2026-33171Statamic has a path traversal in file dictionary fieldtype
- CVE-2026-32612Statamic: privilege escalation via stored cross-site scripting
- CVE-2026-28426Statamic vulnerable to privilege escalation via stored cross-site scripting
- CVE-2026-28425Statamic vulnerable to remote code execution via Antlers-enabled control panel inputs
- CVE-2026-28424Statamic's missing authorization allows access to email addresses
- CVE-2026-28423Statamic Vulnerable to Server-Side Request Forgery via Glide
- CVE-2026-27939Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass