Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-1r77-f41m-gygc
Vulnerability ID VCID-1r77-f41m-gygc
Aliases CVE-2023-48217
GHSA-2r53-9295-3m86
Summary Statamic CMS vulnerable to remote code execution via form uploads Statamic is a flat-first, Laravel + Git powered CMS designed for building websites. In affected versions certain additional PHP files crafted to look like images may be uploaded regardless of mime type validation rules. This affects front-end forms using the "Forms" feature, and asset upload fields in the control panel. Malicious users could leverage this vulnerability to upload and execute code. This issue has been patched in versions 3.4.14 and 4.34.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk None
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-434 Unrestricted Upload of File with Dangerous Type
CWE-94 Improper Control of Generation of Code ('Code Injection')
System Score Found at
epss 0.01048 https://api.first.org/data/v1/epss?cve=CVE-2023-48217
cvssv3.1 8.8 https://github.com/statamic/cms
generic_textual HIGH https://github.com/statamic/cms
cvssv3.1 8.8 https://github.com/statamic/cms/commit/4c6fe041e2203a8033e5949ce4a5d9d6c0ad2411
generic_textual HIGH https://github.com/statamic/cms/commit/4c6fe041e2203a8033e5949ce4a5d9d6c0ad2411
cvssv3.1 8.8 https://github.com/statamic/cms/commit/da28afde818d605179fbb63b96eabafabad876b6
generic_textual HIGH https://github.com/statamic/cms/commit/da28afde818d605179fbb63b96eabafabad876b6
cvssv3.1 8.8 https://github.com/statamic/cms/pull/8991
generic_textual HIGH https://github.com/statamic/cms/pull/8991
cvssv3.1 8.8 https://github.com/statamic/cms/pull/8992
generic_textual HIGH https://github.com/statamic/cms/pull/8992
cvssv3.1 8.8 https://github.com/statamic/cms/releases/tag/v3.4.14
generic_textual HIGH https://github.com/statamic/cms/releases/tag/v3.4.14
cvssv3.1 8.8 https://github.com/statamic/cms/releases/tag/v4.34.0
generic_textual HIGH https://github.com/statamic/cms/releases/tag/v4.34.0
cvssv3.1 8.8 https://github.com/statamic/cms/security/advisories/GHSA-2r53-9295-3m86
generic_textual HIGH https://github.com/statamic/cms/security/advisories/GHSA-2r53-9295-3m86
cvssv3.1 8.8 https://nvd.nist.gov/vuln/detail/CVE-2023-48217
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2023-48217
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2023-48217
https://github.com/statamic/cms
https://github.com/statamic/cms/commit/4c6fe041e2203a8033e5949ce4a5d9d6c0ad2411
https://github.com/statamic/cms/commit/da28afde818d605179fbb63b96eabafabad876b6
https://github.com/statamic/cms/pull/8991
https://github.com/statamic/cms/pull/8992
https://github.com/statamic/cms/releases/tag/v3.4.14
https://github.com/statamic/cms/releases/tag/v4.34.0
CVE-2023-48217 https://nvd.nist.gov/vuln/detail/CVE-2023-48217
GHSA-2r53-9295-3m86 https://github.com/advisories/GHSA-2r53-9295-3m86
GHSA-2r53-9295-3m86 https://github.com/statamic/cms/security/advisories/GHSA-2r53-9295-3m86
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/statamic/cms
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/statamic/cms/commit/4c6fe041e2203a8033e5949ce4a5d9d6c0ad2411
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/statamic/cms/commit/da28afde818d605179fbb63b96eabafabad876b6
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/statamic/cms/pull/8991
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/statamic/cms/pull/8992
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/statamic/cms/releases/tag/v3.4.14
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/statamic/cms/releases/tag/v4.34.0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/statamic/cms/security/advisories/GHSA-2r53-9295-3m86
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-48217
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.77819
EPSS Score 0.01048
Published At May 30, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-30T21:02:31.600771+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/statamic/cms/CVE-2023-48217.yml 38.6.0