Statamic vulnerabilities
43 CVEs and advisories name Statamic as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-27593Statamic is vulnerable to account takeover via password reset link injection
- CVE-2026-27196Statamic affected by privilege escalation via stored Cross-site Scripting
- CVE-2026-25759Statmatic affected by privilege escalation via stored cross-site scripting
- CVE-2026-25633Statamic's missing authorization allows access to assets
- CVE-2025-64112Statmatic vulnerable to Stored Cross-Site Scripting
- CVE-2024-52600Statamic CMS has Path Traversal in Asset Upload
- CVE-2024-36119Password confirmation stored in plain text via registration form in statamic/cms
- CVE-2024-24570Statamic account takeover via XSS and password reset link
- CVE-2023-48701Statamic CMS vulnerable to Cross-site Scripting via uploaded assets
- CVE-2023-48217Remote code execution via form uploads in statamic/cms
- CVE-2023-47129Statamic CMS remote code execution via front-end form uploads
- CVE-2023-36828Statamic's Antlers sanitizer cannot effectively sanitize malicious SVG
- CVE-2022-24784Discoverability of user password hash in Statamic CMS