Search for packages
| purl | pkg:composer/statamic/cms@3.2.21 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-2jq7-5yxn-hubp
Aliases: CVE-2026-33172 GHSA-7rcv-55mj-chg7 |
Statamic has Stored XSS via SVG Sanitization Bypass ### Impact Stored XSS vulnerability in SVG asset reuploads allows authenticated users with asset upload permissions to bypass SVG sanitization and inject malicious JavaScript that executes when the asset is viewed. ### Patches This has been fixed in 5.73.14 and 6.7.0. |
Affected by 8 other vulnerabilities. Affected by 8 other vulnerabilities. |
|
VCID-2pmt-5bu3-6qfd
Aliases: CVE-2025-64112 GHSA-g59r-24g3-h7cm |
Statamic Vulnerable to Superadmin Account Takeover via Stored Cross-Site Scripting and Lack of Proper X-CSRF-TOKEN Server-Side Validation Stored XSS vulnerabilities in Collections and Taxonomies allow authenticated users with content creation permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. This affects: - Control panel users with permission to create or edit Collections and Taxonomies - Versions up to and including 5.22.0 The vulnerability can be exploited to: - Change a super admin's password (versions ≤ 5.21.0) - Change a super admin's email address to initiate password reset (version 5.22.0) - Gain unauthorized access to superadmin accounts The attack requires: - An authenticated user with control panel and content creation permissions - A super admin to view the compromised content |
Affected by 17 other vulnerabilities. |
|
VCID-5q2z-t8ka-nfff
Aliases: CVE-2026-28423 GHSA-cwpp-325q-2cvp |
Statamic Vulnerable to Server-Side Request Forgery via Glide When Glide image manipulation is used in insecure mode (which is *not* the default), the image proxy can be abused by an unauthenticated user to make the server send HTTP requests to arbitrary URLs—either via the URL directly or via the watermark feature. That can allow access to internal services, cloud metadata endpoints, and other hosts reachable from the server. |
Affected by 11 other vulnerabilities. Affected by 12 other vulnerabilities. |
|
VCID-69px-5kah-8bbx
Aliases: CVE-2026-33887 GHSA-4hp7-3wxg-cv9q |
Statamic allows unauthorized content access through missing authorization in its revision controllers ### Impact Authenticated Control Panel users could view entry revisions for any collection with revisions enabled, regardless of whether they had the required collection permissions. This bypasses the authorization checks that the main entry controllers enforce, exposing entry field values and blueprint data. Users could also create entry revisions without edit permission, though this only snapshots the existing content state and does not affect published content. ### Patches This has been fixed in 5.73.16 and 6.7.2. |
Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-6pwu-1kkq-dkar
Aliases: CVE-2024-24570 GHSA-vqxq-hvxw-9mv9 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Statamic is a Laravel and Git powered CMS. HTML files crafted to look like jpg files are able to be uploaded, allowing for XSS. This affects the front-end forms with asset fields without any mime type validation, asset fields in the control panel, and asset browser in the control panel. Additionally, if the XSS is crafted in a specific way, the "copy password reset link" feature may be exploited to gain access to a user's password reset token and gain access to their account. The authorized user is required to execute the XSS in order for the vulnerability to occur. In versions 4.46.0 and 3.4.17, the XSS vulnerability has been patched, and the copy password reset link functionality has been disabled. |
Affected by 19 other vulnerabilities. Affected by 19 other vulnerabilities. |
|
VCID-7329-yjw5-nqgx
Aliases: CVE-2023-47129 GHSA-72hg-5wr5-rmfc |
Statamic CMS remote code execution via front-end form uploads Statmic is a core Laravel content management system Composer package. Prior to versions 3.4.13 and 4.33.0, on front-end forms with an asset upload field, PHP files crafted to look like images may be uploaded. This only affects forms using the "Forms" feature and not just _any_ arbitrary form. This does not affect the control panel. This issue has been patched in 3.4.13 and 4.33.0. |
Affected by 22 other vulnerabilities. Affected by 22 other vulnerabilities. |
|
VCID-7fsn-ddsh-zbac
Aliases: CVE-2026-33883 GHSA-3jg4-p23x-p4qx |
Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag ### Impact The `user:reset_password_form` tag could render user-input directly into HTML without escaping, allowing an attacker to craft a URL that executes arbitrary JavaScript in the victim's browser. ### Patches This has been fixed in 5.73.16 and 6.7.2. |
Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-7jn5-qd6y-vbg9
Aliases: CVE-2024-52600 GHSA-p7f6-8mcm-fwv3 |
Statamic CMS has a Path Traversal in Asset Upload Assets uploaded with appropriately crafted filenames may result in them being placed in a location different than what was configured. |
Affected by 18 other vulnerabilities. |
|
VCID-88c2-bant-c3f7
Aliases: CVE-2026-33177 GHSA-wh3h-gvc4-cc2g |
Statamic is missing authorization check on taxonomy term creation via fieldtype ### Impact Low-privileged Control Panel users could create taxonomy terms by submitting requests to the field action processing endpoint with attacker-controlled field definitions. This bypasses the authorization checks enforced on the standard taxonomy term creation endpoint. ### Patches This has been fixed in 5.73.14 and 6.7.0. |
Affected by 8 other vulnerabilities. Affected by 8 other vulnerabilities. |
|
VCID-a56w-4c8c-jqd7
Aliases: CVE-2023-48217 GHSA-2r53-9295-3m86 |
Statamic CMS vulnerable to remote code execution via form uploads Statamic is a flat-first, Laravel + Git powered CMS designed for building websites. In affected versions certain additional PHP files crafted to look like images may be uploaded regardless of mime type validation rules. This affects front-end forms using the "Forms" feature, and asset upload fields in the control panel. Malicious users could leverage this vulnerability to upload and execute code. This issue has been patched in versions 3.4.14 and 4.34.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. |
Affected by 21 other vulnerabilities. Affected by 20 other vulnerabilities. Affected by 21 other vulnerabilities. |
|
VCID-dcz8-ptts-fudz
Aliases: CVE-2026-33885 GHSA-7f74-7q5w-hj4r |
Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential ### Impact The external URL detection used for redirect validation on unauthenticated endpoints could be bypassed, allowing users to be redirected to external URLs after actions like form submissions and authentication flows. ### Patches This has been fixed in 5.73.16 and 6.7.2. |
Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-enub-vz6v-sqck
Aliases: CVE-2022-24784 GHSA-qcgx-7p5f-hxvr |
Inadequate Encryption Strength Statamic is a Laravel and Git powered CMS. Before versions 3.2.39 and 3.3.2, it is possible to confirm a single character of a user's password hash using a specially crafted regular expression filter in the users endpoint of the REST API. Multiple such requests can eventually uncover the entire hash. The hash is not present in the response, however the presence or absence of a result confirms if the character is in the right position. The API has throttling enabled by default, making this a time intensive task. Both the REST API and the users endpoint need to be enabled, as they are disabled by default. The issue has been fixed in versions 3.2.39 and above, and 3.3.2 and above. |
Affected by 24 other vulnerabilities. Affected by 24 other vulnerabilities. |
|
VCID-f9mc-yupq-nkdm
Aliases: CVE-2026-28426 GHSA-5vrj-wf7v-5wr7 |
Statamic vulnerable to privilege escalation via stored cross-site scripting Stored XSS vulnerability in svg and icon related components allow authenticated users with appropriate permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. |
Affected by 11 other vulnerabilities. Affected by 12 other vulnerabilities. |
|
VCID-gxvz-s2qn-uqbe
Aliases: CVE-2026-28424 GHSA-w878-f8c6-7r63 |
Statamic's missing authorization allows access to email addresses User email addresses were included in responses from the user fieldtype’s data endpoint for control panel users who did not have the “view users” permission. |
Affected by 11 other vulnerabilities. Affected by 12 other vulnerabilities. |
|
VCID-kjqn-zv4f-zyak
Aliases: CVE-2026-33882 GHSA-cvh3-23vq-w7h4 |
Statamic's Markdown preview endpoint exposes sensitive user data ### Impact The markdown preview endpoint could be manipulated to return augmented data from arbitrary fieldtypes. With the users fieldtype specifically, an authenticated control panel user could retrieve sensitive user data including email addresses, encrypted passkey data, and encrypted two-factor authentication codes. ### Patches This has been fixed in 5.73.16 and 6.7.2. |
Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-md5z-7r9y-u7bg
Aliases: CVE-2026-27196 GHSA-8r7r-f4gm-wcpq |
Statamic affected by privilege escalation via stored cross-site scripting Stored XSS vulnerability in `html` fieldtypes allow authenticated users with field management permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. |
Affected by 15 other vulnerabilities. Affected by 17 other vulnerabilities. |
|
VCID-n1wb-964r-zubv
Aliases: CVE-2026-41175 GHSA-4jjr-vmv7-wh4w |
Statamic: Unsafe method invocation via query value resolution allows data destruction ### Impact Manipulating query parameters on Control Panel and REST API endpoints, or arguments in GraphQL queries, could result in the loss of content, assets, and user accounts. The Control Panel requires authentication with minimal permissions in order to exploit. e.g. "view entries" permission to delete entries, or "view users" permission to delete users, etc. The REST and GraphQL API exploits do not require any permissions, however neither are enabled by default. In order to be exploited, they would need to be explicitly enabled with no authentication configured, and the specific resources enabled too. Sites that enable the REST or GraphQL API without authentication should treat patching as critical priority. ### Patches This has been fixed in 5.73.20 and 6.13.0. |
Affected by 1 other vulnerability. Affected by 1 other vulnerability. |
|
VCID-nax6-fhk7-rudm
Aliases: CVE-2026-25633 GHSA-gwmx-9gcj-332h |
Statamic CMS's missing authorization allows access to assets Users without permission to view assets are able are able to download them and view their metadata. Logged-out users and users without permission to access the control panel are unable to take advantage of this. |
Affected by 16 other vulnerabilities. Affected by 18 other vulnerabilities. |
|
VCID-pf25-j1qp-nygr
Aliases: CVE-2026-28425 GHSA-cpv7-q2wx-m8rw |
Statamic vulnerable to remote code execution via Antlers-enabled control panel inputs An authenticated control panel user with access to Antlers-enabled inputs may be able to achieve remote code execution in the application context. That can lead to full compromise of the application, including access to sensitive configuration, modification or exfiltration of data, and potential impact on availability. Exploitation is only possible where Antlers runs on user-controlled content—for example, content fields with Antlers explicitly enabled (requiring permission to configure fields and to edit entries), built-in config that supports Antlers such as Forms email notification settings (requiring configuration permission), or third-party addons that add Antlers-enabled fields to entries (for example, the SEO Pro addon). In each case the attacker must have the relevant control panel permissions. |
Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-saqn-jmc9-mudb
Aliases: CVE-2026-33884 GHSA-8vwx-ccf6-5wg2 |
Statamic's live preview token bypasses content protection for unrelated entries ### Impact An authenticated Control Panel user with access to live preview could use a live preview token to access restricted content that the token was not intended for. ### Patches This has been fixed in 5.73.16 and 6.7.2. |
Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-tff1-wegz-pbc9
Aliases: CVE-2026-33171 GHSA-qm7r-wwq7-6f85 |
Statamic has a path traversal in file dictionary fieldtype ### Impact Authenticated Control Panel users could read arbitrary `.json`, `.yaml`, and `.csv` files from the server by manipulating the file dictionary's `filename` configuration parameter in the fieldtype's endpoint. ### Patches This has been fixed in 5.73.14 and 6.7.0. |
Affected by 8 other vulnerabilities. Affected by 8 other vulnerabilities. |
|
VCID-wjgz-btnr-67cv
Aliases: CVE-2026-27593 GHSA-jxq9-79vj-rgvw |
Statamic is vulnerable to account takeover via password reset link injection An attacker may leverage a vulnerability in the password reset feature to capture a user's token and reset the password on their behalf. The attacker must know the email address of a valid account on the site, and the actual user must blindly click the link in their email even though they didn't request the reset. |
Affected by 14 other vulnerabilities. Affected by 8 other vulnerabilities. |
|
VCID-xyrx-z921-8qdg
Aliases: CVE-2026-44306 GHSA-m24v-f7g5-gq67 |
Statamic CMS vulnerable to email enumeration via forgot password endpoint ### Impact Responses from the forgot password forms hinted at whether an account existed for a given email address. An unauthenticated attacker could use this to enumerate valid users, which can aid in follow-up credential-based attacks. ### Patches This has been fixed in 5.73.21 and 6.15.0. The forgot password forms now return the same generic response regardless of whether the submitted email matches a registered user. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-yure-1mrw-jfeu
Aliases: CVE-2023-36828 GHSA-6r5g-cq4q-327g |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Statamic is a flat-first, Laravel and Git powered content management system. Prior to version 4.10.0, the SVG tag does not sanitize malicious SVG. Therefore, an attacker can exploit this vulnerability to perform cross-site scripting attacks using SVG, even when using the `sanitize` function. Version 4.10.0 contains a patch for this issue. |
Affected by 23 other vulnerabilities. |
|
VCID-z4dm-tpj4-5ya4
Aliases: CVE-2023-48701 GHSA-8jjh-j3c2-cjcv |
Cross-site Scripting via uploaded assets Statamic CMS is a Laravel and Git powered content management system (CMS). Prior to versions 3.4.15 an 4.36.0, HTML files crafted to look like images may be uploaded regardless of mime validation. This is only applicable on front-end forms using the "Forms" feature containing an assets field, or within the control panel which requires authentication. This issue has been patched on 3.4.15 and 4.36.0. |
Affected by 20 other vulnerabilities. Affected by 20 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||