Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-a56w-4c8c-jqd7
Vulnerability ID VCID-a56w-4c8c-jqd7
Aliases CVE-2023-48217
GHSA-2r53-9295-3m86
Summary Statamic CMS vulnerable to remote code execution via form uploads Statamic is a flat-first, Laravel + Git powered CMS designed for building websites. In affected versions certain additional PHP files crafted to look like images may be uploaded regardless of mime type validation rules. This affects front-end forms using the "Forms" feature, and asset upload fields in the control panel. Malicious users could leverage this vulnerability to upload and execute code. This issue has been patched in versions 3.4.14 and 4.34.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
There are no known severity scores.
Reference id Reference type URL
https://github.com/statamic/cms/commit/4c6fe041e2203a8033e5949ce4a5d9d6c0ad2411
https://github.com/statamic/cms/commit/da28afde818d605179fbb63b96eabafabad876b6
https://github.com/statamic/cms/pull/8991
https://github.com/statamic/cms/pull/8992
https://github.com/statamic/cms/releases/tag/v3.4.14
https://github.com/statamic/cms/releases/tag/v4.34.0
CVE-2023-48217 https://nvd.nist.gov/vuln/detail/CVE-2023-48217
GHSA-2r53-9295-3m86 https://github.com/advisories/GHSA-2r53-9295-3m86
GHSA-2r53-9295-3m86 https://github.com/statamic/cms/security/advisories/GHSA-2r53-9295-3m86
No exploits are available.
There are no known vectors.

No EPSS data available for this vulnerability.

Date Actor Action Source VulnerableCode Version
2026-06-02T04:46:19.406482+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/statamic/cms/CVE-2023-48217.yml 38.6.0