Advisories / composer / statamic

composer

statamic/cms

Security advisories for statamic/cms, newest first. 44 known, 3 without a fix yet.

RSS feed Check your lock file →

Latest version

6.38.0

Advisories

44 · 3 unfixed

Last advisory

6 Aug 2026

Safe from

no fix for all yet

44 advisories · newest first

MODERATE6.1 6 Aug 2026

Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template

GHSA-vx89-p3j7-8xqc · CVE-2026-71435

Affected

< 5.74.3 ≥ 6.0.0, < 6.24.2

Fixed in

5.74.3 6.24.2

Published

6 Aug 2026

MODERATE5.3 6 Aug 2026

Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types

GHSA-qhr7-v3xp-vw9m · CVE-2026-71434

Affected

< 5.74.3 ≥ 6.0.0, < 6.24.2

Fixed in

5.74.3 6.24.2

Published

6 Aug 2026

MODERATE6.5 6 Aug 2026

Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries

GHSA-qh8c-7588-qfrv · CVE-2026-64662

Affected

< 5.74.1 ≥ 6.0.0, < 6.24.0

Fixed in

5.74.1 6.24.0

Published

6 Aug 2026

MODERATE6.5 6 Aug 2026

Statamic: Unsafe method invocation via Antlers template resolution allows data destruction

GHSA-j2vp-f2pv-5rj4 · CVE-2026-64663

Affected

< 5.74.1 ≥ 6.0.0, < 6.24.0

Fixed in

5.74.1 6.24.0

Published

6 Aug 2026

HIGH8.1 6 Aug 2026

Statamic: Account takeover via OAuth email matching without email-verification check

GHSA-93qh-5269-9wcf · CVE-2026-64665

Affected

< 5.74.1 ≥ 6.0.0, < 6.24.0

Fixed in

5.74.1 6.24.0

Published

6 Aug 2026

MODERATE4.3 6 Aug 2026

Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence

GHSA-225x-3jhx-wh4q · CVE-2026-64664

Affected

< 5.74.1 ≥ 6.0.0, < 6.24.0

Fixed in

5.74.1 6.24.0

Published

6 Aug 2026

MODERATE6.2 5 Aug 2026

Statamic CMS exposes two-factor recovery codes through dynamic Antlers rendering

GHSA-jppw-r5j3-xf7x · CVE-2026-71293

Affected

≥ 6.0.0-alpha.1, ≤ 6.30.0

Fixed in

no fix yet

Published

5 Aug 2026

LOW3.5 26 Jun 2026

Statamic CMS's incorrect authorization lets view-only users submit Live Preview content reserved for editors

GHSA-7mqq-4v55-88gh · CVE-2026-54244

Affected

< 5.74.0 ≥ 6.0.0, < 6.20.3

Fixed in

5.74.0 6.20.3

Published

26 Jun 2026

MODERATE6.1 26 Jun 2026

Statamic Vulnerable to CSV formula injection in form submission exports

GHSA-h77m-qrj7-jxcw · CVE-2026-54243

Affected

< 5.73.24 ≥ 6.0.0, < 6.20.1

Fixed in

5.73.24 6.20.1

Published

26 Jun 2026

MODERATE4.9 26 Jun 2026

Statamic Vulnerable to Server-Side Request Forgery via Glide (DNS rebinding)

GHSA-v5c4-wcpj-x73m · CVE-2026-54242

Affected

< 5.73.24 ≥ 6.0.0, < 6.20.1

Fixed in

5.73.24 6.20.1

Published

26 Jun 2026

HIGH7.4 26 Jun 2026

Statamic CMS's unsafe method invocation via collection sorting allows data destruction

GHSA-m92m-r54r-x8r2 · CVE-2026-49287

Affected

< 5.73.23 ≥ 6.0.0, < 6.20.0

Fixed in

5.73.23 6.20.0

Published

26 Jun 2026

MODERATE4.3 26 Jun 2026

Statamic CMS: Missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources

GHSA-2497-6pwj-pwg7 · CVE-2026-49288

Affected

< 5.73.23 ≥ 6.0.0, < 6.20.0

Fixed in

5.73.23 6.20.0

Published

26 Jun 2026

MODERATE5.4 18 May 2026

Statamic CMS: Server-Side Request Forgery via Glide

GHSA-pf9c-ch8r-2958 · CVE-2026-45660

Affected

< 5.73.22 ≥ 6.0.0-alpha.1, < 6.18.1

Fixed in

5.73.22 6.18.1

Published

18 May 2026

MODERATE5.3 6 May 2026

Statamic CMS vulnerable to email enumeration via forgot password endpoint

GHSA-m24v-f7g5-gq67 · CVE-2026-44306

Affected

< 5.73.21 ≥ 6.0.0, < 6.15.0

Fixed in

5.73.21 6.15.0

Published

6 May 2026

HIGH8.1 16 Apr 2026

Statamic: Unsafe method invocation via query value resolution allows data destruction

GHSA-4jjr-vmv7-wh4w · CVE-2026-41175

Affected

< 5.73.20 ≥ 6.0.0-alpha.1, < 6.13.0

Fixed in

5.73.20 6.13.0

Published

16 Apr 2026

MODERATE5.4 26 Mar 2026

Statamic allows unauthorized content access through missing authorization in its revision controllers

GHSA-4hp7-3wxg-cv9q · CVE-2026-33887

Affected

< 5.73.16 ≥ 6.0.0-alpha.1, < 6.7.2

Fixed in

5.73.16 6.7.2

Published

26 Mar 2026

MODERATE6.5 26 Mar 2026

Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields

GHSA-gcqf-5x9f-hq7f · CVE-2026-33886

Affected

≥ 5.73.12, < 5.73.16 ≥ 6.5.0, < 6.7.2

Fixed in

5.73.16 6.7.2

Published

26 Mar 2026

MODERATE6.1 26 Mar 2026

Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential

GHSA-7f74-7q5w-hj4r · CVE-2026-33885

Affected

< 5.73.16 ≥ 6.0.0.alpha.1, < 6.7.2

Fixed in

5.73.16 6.7.2

Published

26 Mar 2026

MODERATE4.3 26 Mar 2026

Statamic's live preview token bypasses content protection for unrelated entries

GHSA-8vwx-ccf6-5wg2 · CVE-2026-33884

Affected

< 5.73.16 ≥ 6.0.0-alpha.1, < 6.7.2

Fixed in

5.73.16 6.7.2

Published

26 Mar 2026

MODERATE6.1 26 Mar 2026

Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag

GHSA-3jg4-p23x-p4qx · CVE-2026-33883

Affected

< 5.73.16 ≥ 6.0.0-alpha.1, < 6.7.2

Fixed in

5.73.16 6.7.2

Published

26 Mar 2026

MODERATE6.5 26 Mar 2026

Statamic's Markdown preview endpoint exposes sensitive user data

GHSA-cvh3-23vq-w7h4 · CVE-2026-33882

Affected

< 5.73.16 ≥ 6.0.0-alpha.1, < 6.7.2

Fixed in

5.73.16 6.7.2

Published

26 Mar 2026

MODERATE4.3 18 Mar 2026

Statamic is missing authorization check on taxonomy term creation via fieldtype

GHSA-wh3h-gvc4-cc2g · CVE-2026-33177

Affected

< 5.73.14 ≥ 6.0.0-alpha.1, < 6.7.0

Fixed in

5.73.14 6.7.0

Published

18 Mar 2026

MODERATE4.3 18 Mar 2026

Statamic has a path traversal in file dictionary fieldtype

GHSA-qm7r-wwq7-6f85 · CVE-2026-33171

Affected

< 5.73.14 ≥ 6.0.0-alpha.1, < 6.7.0

Fixed in

5.73.14 6.7.0

Published

18 Mar 2026

HIGH8.7 18 Mar 2026

Statamic has Stored XSS via SVG Sanitization Bypass

GHSA-7rcv-55mj-chg7 · CVE-2026-33172

Affected

< 5.73.14 ≥ 6.0.0-alpha.1, < 6.7.0

Fixed in

5.73.14 6.7.0

Published

18 Mar 2026

MODERATE5.4 13 Mar 2026

Statamic vulnerable to privilege escalation via stored cross-site scripting

GHSA-hcch-w73c-jp4m · CVE-2026-32612

Affected

≥ 6.0.0, < 6.6.2

Fixed in

6.6.2

Published

13 Mar 2026

HIGH8.7 1 Mar 2026

Statamic vulnerable to privilege escalation via stored cross-site scripting

GHSA-5vrj-wf7v-5wr7 · CVE-2026-28426

Affected

< 5.73.11 ≥ 6.0.0-alpha.1, < 6.4.0

Fixed in

5.73.11 6.4.0

Published

1 Mar 2026

HIGH8.0 1 Mar 2026

Statamic vulnerable to remote code execution via Antlers-enabled control panel inputs

GHSA-cpv7-q2wx-m8rw · CVE-2026-28425

Affected

< 5.73.16 ≥ 6.0.0-alpha.1, < 6.7.2

Fixed in

5.73.16 6.7.2

Published

1 Mar 2026

MODERATE6.5 1 Mar 2026

Statamic's missing authorization allows access to email addresses

GHSA-w878-f8c6-7r63 · CVE-2026-28424

Affected

< 5.73.11 ≥ 6.0.0-alpha.1, < 6.4.0

Fixed in

5.73.11 6.4.0

Published

1 Mar 2026

MODERATE6.8 1 Mar 2026

Statamic Vulnerable to Server-Side Request Forgery via Glide

GHSA-cwpp-325q-2cvp · CVE-2026-28423

Affected

< 5.73.11 ≥ 6.0.0-alpha.1, < 6.4.0

Fixed in

5.73.11 6.4.0

Published

1 Mar 2026

HIGH8.8 27 Feb 2026

Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass

GHSA-rw9x-pxqx-q789 · CVE-2026-27939

Affected

≥ 6.0.0, < 6.4.0

Fixed in

6.4.0

Published

27 Feb 2026

CRITICAL9.3 24 Feb 2026

Statamic is vulnerable to account takeover via password reset link injection

GHSA-jxq9-79vj-rgvw · CVE-2026-27593

Affected

< 5.73.10 ≥ 6.0.0-alpha.1, < 6.7.1

Fixed in

5.73.10 6.7.1

Published

24 Feb 2026

HIGH8.1 19 Feb 2026

Statamic affected by privilege escalation via stored cross-site scripting

GHSA-8r7r-f4gm-wcpq · CVE-2026-27196

Affected

< 5.73.9 ≥ 6.0.0-alpha.1, < 6.3.2

Fixed in

5.73.9 6.3.2

Published

19 Feb 2026

HIGH8.7 11 Feb 2026

Statamic CMS vulnerable to privilege escalation via stored cross-site scripting

GHSA-ff9r-ww9c-43x8 · CVE-2026-25759

Affected

≥ 6.0.0, < 6.2.3

Fixed in

6.2.3

Published

11 Feb 2026

MODERATE4.3 11 Feb 2026

Statamic CMS's missing authorization allows access to assets

GHSA-gwmx-9gcj-332h · CVE-2026-25633

Affected

< 5.73.6 ≥ 6.0.0-alpha.1, < 6.2.5

Fixed in

5.73.6 6.2.5

Published

11 Feb 2026

HIGH8.0 30 Oct 2025

Statamic Vulnerable to Superadmin Account Takeover via Stored Cross-Site Scripting and Lack of Proper X-CSRF-TOKEN Server-Side Validation

GHSA-g59r-24g3-h7cm · CVE-2025-64112

Affected

≤ 5.22.0

Fixed in

no fix yet

Published

30 Oct 2025

MODERATE5.3 19 Nov 2024

Statamic CMS has a Path Traversal in Asset Upload

GHSA-p7f6-8mcm-fwv3 · CVE-2024-52600

Affected

≤ 5.16.0

Fixed in

no fix yet

Published

19 Nov 2024

LOW1.8 2 Jun 2024

Password confirmation stored in plain text via registration form in statamic/cms

GHSA-qvpj-w7xj-r6w9 · CVE-2024-36119

Affected

≥ 5.3.0, < 5.6.2

Fixed in

5.6.2

Published

2 Jun 2024

HIGH8.2 1 Feb 2024

Statmic CMS vulnerable to account takeover via XSS and password reset link

GHSA-vqxq-hvxw-9mv9 · CVE-2024-24570

Affected

< 3.4.17 ≥ 4.00, < 4.46.0

Fixed in

3.4.17 4.46.0

Published

1 Feb 2024

HIGH7.5 22 Nov 2023

Cross-site Scripting via uploaded assets

GHSA-8jjh-j3c2-cjcv · CVE-2023-48701

Affected

< 3.4.15 ≥ 4.0.0, < 4.36.0

Fixed in

3.4.15 4.36.0

Published

22 Nov 2023

HIGH8.8 14 Nov 2023

Statamic CMS vulnerable to remote code execution via form uploads

GHSA-2r53-9295-3m86 · CVE-2023-48217

Affected

< 3.4.14 ≥ 4.0.0, < 4.34.0

Fixed in

3.4.14 4.34.0

Published

14 Nov 2023

HIGH8.3 12 Nov 2023

Statamic CMS remote code execution via front-end form uploads

GHSA-72hg-5wr5-rmfc · CVE-2023-47129

Affected

< 3.4.13 ≥ 4.0.0, < 4.33.0

Fixed in

3.4.13 4.33.0

Published

12 Nov 2023

MODERATE5.5 6 Jul 2023

Statamic's Antlers sanitizer cannot effectively sanitize malicious SVG

GHSA-6r5g-cq4q-327g · CVE-2023-36828

Affected

< 4.10.0

Fixed in

4.10.0

Published

6 Jul 2023

HIGH8.8 13 May 2022

Statamic framework Incorrect Permission Assignment

GHSA-5m64-9hq5-5pf2 · CVE-2017-11422

Affected

< 2.6.0

Fixed in

2.6.0

Published

13 May 2022

LOW3.7 29 Mar 2022

Discoverability of user password hash in Statamic CMS

GHSA-qcgx-7p5f-hxvr · CVE-2022-24784

Affected

< 3.2.39 ≥ 3.3.0, < 3.3.2

Fixed in

3.2.39 3.3.2

Published

29 Mar 2022

/advisories/composer/statamic/cms/feed.rss

From Packagist and the GitHub advisory database · synced hourly

Know when your sites are affected.

Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.

Start your free trial →