Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-7329-yjw5-nqgx
Vulnerability ID VCID-7329-yjw5-nqgx
Aliases CVE-2023-47129
GHSA-72hg-5wr5-rmfc
Summary Statamic CMS remote code execution via front-end form uploads Statmic is a core Laravel content management system Composer package. Prior to versions 3.4.13 and 4.33.0, on front-end forms with an asset upload field, PHP files crafted to look like images may be uploaded. This only affects forms using the "Forms" feature and not just _any_ arbitrary form. This does not affect the control panel. This issue has been patched in 3.4.13 and 4.33.0.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
There are no known severity scores.
Reference id Reference type URL
https://github.com/statamic/cms/commit/098ef8024d97286ca501273c18ae75b646262d75
https://github.com/statamic/cms/commit/f6c688154f6bdbd0b67039f8f11dcd98ba061e77
CVE-2023-47129 https://nvd.nist.gov/vuln/detail/CVE-2023-47129
GHSA-72hg-5wr5-rmfc https://github.com/advisories/GHSA-72hg-5wr5-rmfc
GHSA-72hg-5wr5-rmfc https://github.com/statamic/cms/security/advisories/GHSA-72hg-5wr5-rmfc
No exploits are available.
There are no known vectors.

No EPSS data available for this vulnerability.

Date Actor Action Source VulnerableCode Version
2026-06-02T04:46:18.838219+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/statamic/cms/CVE-2023-47129.yml 38.6.0