# cve.now: Statamic

The newest entries naming Statamic as an affected vendor (up to 200), of 43 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-71435](https://cve.now/CVE-2026-71435.md): Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template (CVSS 6.1)
- [CVE-2026-71434](https://cve.now/CVE-2026-71434.md): Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types (CVSS 5.3)
- [CVE-2026-64662](https://cve.now/CVE-2026-64662.md): Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries (CVSS 6.5)
- [CVE-2026-64663](https://cve.now/CVE-2026-64663.md): Statamic: Unsafe method invocation via Antlers template resolution allows data destruction (CVSS 6.5)
- [CVE-2026-64665](https://cve.now/CVE-2026-64665.md): Statamic: Account takeover via OAuth email matching without email-verification check (CVSS 8.1)
- [CVE-2026-64664](https://cve.now/CVE-2026-64664.md): Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence (CVSS 4.3)
- [CVE-2026-71293](https://cve.now/CVE-2026-71293.md): Statamic CMS Unguarded Exposure of 2FA Recovery Codes via Antlers current\_user Variable (CVSS 6.2)
- [CVE-2026-54243](https://cve.now/CVE-2026-54243.md): Statamic: CSV formula injection in form submission exports (CVSS 6.1)
- [CVE-2026-54242](https://cve.now/CVE-2026-54242.md): Statamic: Server-Side Request Forgery via Glide (DNS rebinding) (CVSS 4.9)
- [CVE-2026-54244](https://cve.now/CVE-2026-54244.md): Statamic: Incorrect authorization lets view-only users submit Live Preview content reserved for editors (CVSS 3.5)
- [CVE-2026-49288](https://cve.now/CVE-2026-49288.md): Statamic CMS missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources (CVSS 4.3)
- [CVE-2026-49287](https://cve.now/CVE-2026-49287.md): Statamic CMS vulnerable to unsafe method invocation via collection sorting allows data destruction (CVSS 7.4)
- [CVE-2026-45660](https://cve.now/CVE-2026-45660.md): Statamic: Server-Side Request Forgery via Glide (CVSS 5.4)
- [CVE-2026-44306](https://cve.now/CVE-2026-44306.md): Statamic: Email enumeration via forgot password endpoint (CVSS 5.3)
- [CVE-2026-41175](https://cve.now/CVE-2026-41175.md): Statamic: Unsafe method invocation via query value resolution allows data destruction (CVSS 8.1)
- [CVE-2026-33887](https://cve.now/CVE-2026-33887.md): Statamic allows unauthorized content access through missing authorization in its revision controllers (CVSS 5.4)
- [CVE-2026-33886](https://cve.now/CVE-2026-33886.md): Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields (CVSS 6.5)
- [CVE-2026-33885](https://cve.now/CVE-2026-33885.md): Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential (CVSS 6.1)
- [CVE-2026-33884](https://cve.now/CVE-2026-33884.md): Statamic's live preview token bypasses content protection for unrelated entries (CVSS 4.3)
- [CVE-2026-33883](https://cve.now/CVE-2026-33883.md): Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag (CVSS 6.1)
- [CVE-2026-33882](https://cve.now/CVE-2026-33882.md): Statamic's Markdown preview endpoint exposes sensitive user data (CVSS 6.5)
- [CVE-2026-33177](https://cve.now/CVE-2026-33177.md): Statamic is missing authorization check on taxonomy term creation via fieldtype (CVSS 4.3)
- [CVE-2026-33172](https://cve.now/CVE-2026-33172.md): Statamic has Stored XSS via SVG Sanitization Bypass (CVSS 8.7)
- [CVE-2026-33171](https://cve.now/CVE-2026-33171.md): Statamic has a path traversal in file dictionary fieldtype (CVSS 4.3)
- [CVE-2026-32612](https://cve.now/CVE-2026-32612.md): Statamic: privilege escalation via stored cross-site scripting (CVSS 5.4)
- [CVE-2026-28426](https://cve.now/CVE-2026-28426.md): Statamic vulnerable to privilege escalation via stored cross-site scripting (CVSS 8.7)
- [CVE-2026-28425](https://cve.now/CVE-2026-28425.md): Statamic vulnerable to remote code execution via Antlers-enabled control panel inputs (CVSS 8.0)
- [CVE-2026-28424](https://cve.now/CVE-2026-28424.md): Statamic's missing authorization allows access to email addresses (CVSS 6.5)
- [CVE-2026-28423](https://cve.now/CVE-2026-28423.md): Statamic Vulnerable to Server-Side Request Forgery via Glide (CVSS 6.8)
- [CVE-2026-27939](https://cve.now/CVE-2026-27939.md): Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass (CVSS 8.8)
- [CVE-2026-27593](https://cve.now/CVE-2026-27593.md): Statamic is vulnerable to account takeover via password reset link injection (CVSS 9.3)
- [CVE-2026-27196](https://cve.now/CVE-2026-27196.md): Statamic affected by privilege escalation via stored Cross-site Scripting (CVSS 8.1)
- [CVE-2026-25759](https://cve.now/CVE-2026-25759.md): Statmatic affected by privilege escalation via stored cross-site scripting (CVSS 8.7)
- [CVE-2026-25633](https://cve.now/CVE-2026-25633.md): Statamic's missing authorization allows access to assets (CVSS 4.3)
- [CVE-2025-64112](https://cve.now/CVE-2025-64112.md): Statmatic vulnerable to Stored Cross-Site Scripting (CVSS 8.0)
- [CVE-2024-52600](https://cve.now/CVE-2024-52600.md): Statamic CMS has Path Traversal in Asset Upload (CVSS 5.3)
- [CVE-2024-36119](https://cve.now/CVE-2024-36119.md): Password confirmation stored in plain text via registration form in statamic/cms (CVSS 1.8)
- [CVE-2024-24570](https://cve.now/CVE-2024-24570.md): Statamic account takeover via XSS and password reset link (CVSS 8.2)
- [CVE-2023-48701](https://cve.now/CVE-2023-48701.md): Statamic CMS vulnerable to Cross-site Scripting via uploaded assets (CVSS 7.5)
- [CVE-2023-48217](https://cve.now/CVE-2023-48217.md): Remote code execution via form uploads in statamic/cms (CVSS 8.8)
- [CVE-2023-47129](https://cve.now/CVE-2023-47129.md): Statamic CMS remote code execution via front-end form uploads (CVSS 8.4)
- [CVE-2023-36828](https://cve.now/CVE-2023-36828.md): Statamic's Antlers sanitizer cannot effectively sanitize malicious SVG (CVSS 5.5)
- [CVE-2022-24784](https://cve.now/CVE-2022-24784.md): Discoverability of user password hash in Statamic CMS (CVSS 3.7)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/statamic
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.