Cms (Statamic) - vulnerabilities (CVEs)

43 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2026-08-06. Vendor: Statamic.

CVEs of Cms

CVE-2026-71435 - CVSS 6.1 (medium), 2026-08-06: Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, the default ("automagic") form notification email rendered…
CVE-2026-71434 - CVSS 5.3 (medium), 2026-08-06: Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, public frontend forms did not enforce the file upload…
CVE-2026-64662 - CVSS 6.5 (medium), 2026-08-06: Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could view content from…
CVE-2026-64663 - CVSS 6.5 (medium), 2026-08-06: Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, manipulating user-supplied input incorporated into Antlers…
CVE-2026-64665 - CVSS 8.1 (high), 2026-08-06: Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, when OAuth login was enabled with a provider that does not…
CVE-2026-64664 - CVSS 4.3 (medium), 2026-08-06: Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could use an endpoint…
CVE-2026-71293 - CVSS 6.2 (medium), 2026-08-05: Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the handle that returns the user's…
CVE-2026-54243 - CVSS 6.1 (medium), 2026-07-17: Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.24 and 6.20.1, form submission values in…
CVE-2026-54242 - CVSS 4.9 (medium), 2026-07-17: Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.24 and 6.20.1, the Glide image proxy's URL validation in…
CVE-2026-54244 - CVSS 3.5 (low), 2026-07-17: Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.0 and 6.20.3, the Live Preview endpoint for existing entries and terms in…
CVE-2026-49288 - CVSS 4.3 (medium), 2026-06-19: Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 and 6.20.0, an authenticated Control Panel user could view metadata…
CVE-2026-49287 - CVSS 7.4 (high), 2026-06-19: Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 and 6.20.0, the fix for CVE-2026-41175 was incomplete. It addressed…
CVE-2026-45660 - CVSS 5.4 (medium), 2026-05-29: Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.22 and 6.18.1, the Glide image proxy's URL validation could be bypassed…
CVE-2026-44306 - CVSS 5.3 (medium), 2026-05-12: Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.21 and 6.15.0, responses from the forgot password forms hinted at whether…
CVE-2026-41175 - CVSS 8.1 (high), 2026-04-22: Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.20 and 6.13.0, manipulating query parameters on Control Panel…
CVE-2026-33884 - CVSS 4.3 (medium), 2026-03-27: Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, an authenticated Control Panel user with access to…
CVE-2026-33887 - CVSS 5.4 (medium), 2026-03-27: Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, authenticated Control Panel users could view entry…
CVE-2026-33883 - CVSS 6.1 (medium), 2026-03-27: Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, the `user:reset_password_form` tag could render…
CVE-2026-33886 - CVSS 6.5 (medium), 2026-03-27: Statamic is a Laravel and Git powered content management system (CMS). Starting in version 5.7.12 and prior to versions 5.73.16 and 6.7.2, a control panel…
CVE-2026-33885 - CVSS 6.1 (medium), 2026-03-27: Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, the external URL detection used for redirect…
CVE-2026-33882 - CVSS 6.5 (medium), 2026-03-27: Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, the markdown preview endpoint could be manipulated…
CVE-2026-33177 - CVSS 4.3 (medium), 2026-03-20: Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, low-privileged Control Panel users could create…
CVE-2026-33172 - CVSS 8.7 (high), 2026-03-20: Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, a stored XSS vulnerability in SVG asset reuploads…
CVE-2026-33171 - CVSS 4.3 (medium), 2026-03-20: Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, authenticated Control Panel users could read…
CVE-2026-32612 - CVSS 5.4 (medium), 2026-03-13: Statamic is a Laravel and Git powered content management system (CMS). Prior to 6.6.2, stored XSS in the control panel color mode preference allows…
CVE-2026-28423 - CVSS 8.6 (high), 2026-02-27: Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, when Glide image manipulation is used in insecure…
CVE-2026-28426 - CVSS 8.7 (high), 2026-02-27: Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, stored XSS vulnerability in svg and icon related…
CVE-2026-28425 - CVSS 8 (high), 2026-02-27: Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, an authenticated control panel user with access…
CVE-2026-28424 - CVSS 6.5 (medium), 2026-02-27: Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, user email addresses were included in responses…
CVE-2026-27939 - CVSS 8.8 (high), 2026-02-27: Statmatic is a Laravel and Git powered content management system (CMS). Starting in version 6.0.0 and prior to version 6.4.0, Authenticated Control Panel…
CVE-2026-27593 - CVSS 9.3 (critical), 2026-02-24: Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 6.3.3 and 5.73.10, an attacker may leverage a vulnerability in the…
CVE-2026-27196 - CVSS 8.1 (high), 2026-02-21: Statmatic is a Laravel and Git powered content management system (CMS). Versions 5.73.8 and below in addition to 6.0.0-alpha.1 through 6.3.1 have a Stored XSS…
CVE-2026-25759 - CVSS 8.7 (high), 2026-02-11: Statmatic is a Laravel and Git powered content management system (CMS). From 6.0.0 to before 6.2.3, a stored XSS vulnerability in content titles allows…
CVE-2026-25633 - CVSS 4.3 (medium), 2026-02-11: Statamic is a, Laravel + Git powered CMS designed for building websites. Prior to 5.73.6 and 6.2.5, users without permission to view assets are able are able…
CVE-2025-64112 - CVSS 8 (high), 2025-10-30: Statmatic is a Laravel and Git powered content management system (CMS). Stored XSS vulnerabilities in Collections and Taxonomies allow authenticated users…
CVE-2024-52600 - CVSS 5.3 (medium), 2024-11-19: Statmatic is a Laravel and Git powered content management system (CMS). Prior to version 5.17.0, assets uploaded with appropriately crafted filenames may…
CVE-2024-36119 - CVSS 1.8 (low), 2024-05-30: Statamic is a, Laravel + Git powered CMS designed for building websites. In affected versions users registering via the `user:register_form` tag will have…
CVE-2024-24570 - CVSS 8.2 (high), 2024-02-01: Statamic is a Laravel and Git powered CMS. HTML files crafted to look like jpg files are able to be uploaded, allowing for XSS. This affects the front-end…
CVE-2023-48701 - CVSS 7.5 (high), 2023-11-21: Statamic CMS is a Laravel and Git powered content management system (CMS). Prior to versions 3.4.15 an 4.36.0, HTML files crafted to look like images may be…
CVE-2023-48217 - CVSS 8.8 (high), 2023-11-14: Statamic is a flat-first, Laravel + Git powered CMS designed for building websites. In affected versions certain additional PHP files crafted to look like…
CVE-2023-47129 - CVSS 9.8 (critical), 2023-11-10: Statmic is a core Laravel content management system Composer package. Prior to versions 3.4.13 and 4.33.0, on front-end forms with an asset upload field, PHP…
CVE-2023-36828 - CVSS 5.5 (medium), 2023-07-05: Statamic is a flat-first, Laravel and Git powered content management system. Prior to version 4.10.0, the SVG tag does not sanitize malicious SVG. Therefore,…
CVE-2022-24784 - CVSS 3.7 (low), 2022-03-25: Statamic is a Laravel and Git powered CMS. Before versions 3.2.39 and 3.3.2, it is possible to confirm a single character of a user's password hash using a…