Search for packages
| purl | pkg:composer/statamic/cms@6.7.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-69px-5kah-8bbx
Aliases: CVE-2026-33887 GHSA-4hp7-3wxg-cv9q |
Statamic allows unauthorized content access through missing authorization in its revision controllers ### Impact Authenticated Control Panel users could view entry revisions for any collection with revisions enabled, regardless of whether they had the required collection permissions. This bypasses the authorization checks that the main entry controllers enforce, exposing entry field values and blueprint data. Users could also create entry revisions without edit permission, though this only snapshots the existing content state and does not affect published content. ### Patches This has been fixed in 5.73.16 and 6.7.2. |
Affected by 2 other vulnerabilities. |
|
VCID-7fsn-ddsh-zbac
Aliases: CVE-2026-33883 GHSA-3jg4-p23x-p4qx |
Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag ### Impact The `user:reset_password_form` tag could render user-input directly into HTML without escaping, allowing an attacker to craft a URL that executes arbitrary JavaScript in the victim's browser. ### Patches This has been fixed in 5.73.16 and 6.7.2. |
Affected by 2 other vulnerabilities. |
|
VCID-dcz8-ptts-fudz
Aliases: CVE-2026-33885 GHSA-7f74-7q5w-hj4r |
Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential ### Impact The external URL detection used for redirect validation on unauthenticated endpoints could be bypassed, allowing users to be redirected to external URLs after actions like form submissions and authentication flows. ### Patches This has been fixed in 5.73.16 and 6.7.2. |
Affected by 2 other vulnerabilities. |
|
VCID-kjqn-zv4f-zyak
Aliases: CVE-2026-33882 GHSA-cvh3-23vq-w7h4 |
Statamic's Markdown preview endpoint exposes sensitive user data ### Impact The markdown preview endpoint could be manipulated to return augmented data from arbitrary fieldtypes. With the users fieldtype specifically, an authenticated control panel user could retrieve sensitive user data including email addresses, encrypted passkey data, and encrypted two-factor authentication codes. ### Patches This has been fixed in 5.73.16 and 6.7.2. |
Affected by 2 other vulnerabilities. |
|
VCID-n1wb-964r-zubv
Aliases: CVE-2026-41175 GHSA-4jjr-vmv7-wh4w |
Statamic: Unsafe method invocation via query value resolution allows data destruction ### Impact Manipulating query parameters on Control Panel and REST API endpoints, or arguments in GraphQL queries, could result in the loss of content, assets, and user accounts. The Control Panel requires authentication with minimal permissions in order to exploit. e.g. "view entries" permission to delete entries, or "view users" permission to delete users, etc. The REST and GraphQL API exploits do not require any permissions, however neither are enabled by default. In order to be exploited, they would need to be explicitly enabled with no authentication configured, and the specific resources enabled too. Sites that enable the REST or GraphQL API without authentication should treat patching as critical priority. ### Patches This has been fixed in 5.73.20 and 6.13.0. |
Affected by 1 other vulnerability. |
|
VCID-saqn-jmc9-mudb
Aliases: CVE-2026-33884 GHSA-8vwx-ccf6-5wg2 |
Statamic's live preview token bypasses content protection for unrelated entries ### Impact An authenticated Control Panel user with access to live preview could use a live preview token to access restricted content that the token was not intended for. ### Patches This has been fixed in 5.73.16 and 6.7.2. |
Affected by 2 other vulnerabilities. |
|
VCID-vhz9-vavp-hyb6
Aliases: CVE-2026-33886 GHSA-gcqf-5x9f-hq7f |
Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields ### Impact A control panel user with access to Antlers-enabled fields could access sensitive application configuration values by inserting config variables into their content. ### Patches This has been fixed in 5.73.16 and 6.7.2. |
Affected by 2 other vulnerabilities. |
|
VCID-xyrx-z921-8qdg
Aliases: CVE-2026-44306 GHSA-m24v-f7g5-gq67 |
Statamic CMS vulnerable to email enumeration via forgot password endpoint ### Impact Responses from the forgot password forms hinted at whether an account existed for a given email address. An unauthenticated attacker could use this to enumerate valid users, which can aid in follow-up credential-based attacks. ### Patches This has been fixed in 5.73.21 and 6.15.0. The forgot password forms now return the same generic response regardless of whether the submitted email matches a registered user. |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-2jq7-5yxn-hubp | Statamic has Stored XSS via SVG Sanitization Bypass ### Impact Stored XSS vulnerability in SVG asset reuploads allows authenticated users with asset upload permissions to bypass SVG sanitization and inject malicious JavaScript that executes when the asset is viewed. ### Patches This has been fixed in 5.73.14 and 6.7.0. |
CVE-2026-33172
GHSA-7rcv-55mj-chg7 |
| VCID-88c2-bant-c3f7 | Statamic is missing authorization check on taxonomy term creation via fieldtype ### Impact Low-privileged Control Panel users could create taxonomy terms by submitting requests to the field action processing endpoint with attacker-controlled field definitions. This bypasses the authorization checks enforced on the standard taxonomy term creation endpoint. ### Patches This has been fixed in 5.73.14 and 6.7.0. |
CVE-2026-33177
GHSA-wh3h-gvc4-cc2g |
| VCID-tff1-wegz-pbc9 | Statamic has a path traversal in file dictionary fieldtype ### Impact Authenticated Control Panel users could read arbitrary `.json`, `.yaml`, and `.csv` files from the server by manipulating the file dictionary's `filename` configuration parameter in the fieldtype's endpoint. ### Patches This has been fixed in 5.73.14 and 6.7.0. |
CVE-2026-33171
GHSA-qm7r-wwq7-6f85 |