CVE-2026-71434
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, public frontend forms did not enforce the file upload restrictions that the Control Panel enforces, so an unauthenticated visitor could upload file types an administrator had intended to disallow through a form's assets or files field, and for assets fields, files could be stored on a public, web-accessible disk, though the application's global upload allowlist still blocked executable types such as .php and .html. This issue is fixed in versions 5.74.3 and 6.24.2.
Risk Assessment
Unauthenticated users can upload dangerous file types that may be publicly accessible, potentially leading to hosting malicious content or other attacks if files are not properly secured.
Recommendation
Update Statamic to version 5.74.3 or 6.24.2 (or later) to enforce file upload restrictions.
Other vulnerabilities in Statamic
See all- CVE-2026-71435Medium
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, the default ("automagic") form notification email rendered user-submitted values without escaping, allowing an unauthenticated form submitter to inject HTML into the notification emails sent to the configured recipients. This issue is fixed in versions 5.74.3 and 6.24.2.
- CVE-2026-64665High
Statamic before versions 5.74.1 and 6.24.0, when OAuth login is enabled with a provider that does not guarantee verified email addresses, allows an unauthenticated attacker to sign in as an existing user, including a super admin, without knowing the password. This is because the application matches OAuth identities to accounts by email address alone. The issue is fixed in versions 5.74.1 and 6.24.0.
- CVE-2026-64664Medium
In Statamic prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belonged to an existing user, without having permission to view users, though the endpoint only exposed user existence and not any other user data.
- CVE-2026-64663Medium
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, manipulating user-supplied input incorporated into Antlers templates could result in the loss of content and assets, on sites whose templates pass untrusted input into affected areas, and exploitation did not require authentication. This issue is fixed in versions 5.74.1 and 6.24.0.
- CVE-2026-64662Medium
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could view content from entries they did not have permission to view, including entry content and custom field values, from any collection and including unpublished entries, through the navigation endpoint, though no data could be modified. This issue is fixed in versions 5.74.1 and 6.24.0.
- CVE-2026-54243Medium
Statamic CMS prior to versions 5.73.24 and 6.20.1 does not neutralize spreadsheet formula characters in CSV export. Form submission values starting with characters like =, +, -, or @ can be interpreted as live formulas when the file is opened in a spreadsheet application. The attack can be carried out by an unauthenticated front-end user and then triggered by an editor opening the export.
- CVE-2026-54242Medium
Statamic before versions 5.73.24 and 6.20.1 contains a server-side request forgery (SSRF) vulnerability in the Glide image proxy. URL validation in `RemoteUrlValidator.php` and `GuzzleAdapter.php` can be bypassed via DNS rebinding. The hostname is first validated as publicly routable, but when the image is fetched, DNS is resolved again, allowing an attacker to rebind to an internal address after validation and make requests to internal resources, including loopback, private network, and cloud metadata endpoints.
- CVE-2026-45660Medium
Statamic prior to versions 5.73.22 and 6.18.1 contains a vulnerability in the Glide image proxy. URL validation could be bypassed, allowing an unauthenticated attacker to make HTTP requests to internal addresses (loopback, private network, cloud metadata).
Original NVD description (English source)
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, public frontend forms did not enforce the file upload restrictions that the Control Panel enforces, so an unauthenticated visitor could upload file types an administrator had intended to disallow through a form's assets or files field, and for assets fields, files could be stored on a public, web-accessible disk, though the application's global upload allowlist still blocked executable types such as .php and .html. This issue is fixed in versions 5.74.3 and 6.24.2.