CVE-2026-28425 is a critical code injection vulnerability classified under CWE-94 affecting the Statamic content management system, which is built on Laravel and Git. The flaw exists in how Statamic processes Antlers templates—its proprietary templating language—when enabled on user-controllable inputs such as content fields, form email notification settings, or third-party addons like SEO Pro. An authenticated control panel user with permissions to configure fields and edit entries or configure forms can inject malicious code into these Antlers-enabled inputs. Because Antlers templates are parsed and executed within the application context, this injection leads to remote code execution (RCE). This allows attackers to execute arbitrary PHP code, potentially leading to full compromise of the CMS environment, including unauthorized access to sensitive configuration data, modification or exfiltration of stored content, and disruption of availability. The vulnerability affects Statamic versions earlier than 5.73.11 and versions from 6.0.0 up to but not including 6.4.0. Exploitation requires authenticated access with specific permissions, which limits exposure to authorized users but remains a significant risk if credentials are compromised or insider threats exist. The issue has been addressed in Statamic 5.73.11 and 6.4.0 by tightening control over Antlers template processing and input sanitization. No public exploits have been reported yet, but the high CVSS score of 8.0 reflects the severity and potential impact of this vulnerability.

The impact of CVE-2026-28425 is substantial for organizations using Statamic CMS, particularly those with multiple authenticated users having control panel permissions. Successful exploitation can lead to remote code execution, resulting in full system compromise. Attackers could access and exfiltrate sensitive configuration files, modify or delete content, and disrupt service availability. This can cause data breaches, loss of data integrity, and downtime, affecting business continuity and reputation. Since the vulnerability requires authenticated access with specific permissions, the risk is heightened in environments where user credentials are weak, reused, or compromised. Additionally, third-party addons that enable Antlers on user inputs expand the attack surface. Organizations relying on Statamic for public-facing websites or internal portals may face regulatory and compliance risks if sensitive data is exposed. The absence of known exploits in the wild currently reduces immediate risk, but the vulnerability's nature and high severity score warrant urgent remediation to prevent future attacks.

To mitigate CVE-2026-28425, organizations should immediately upgrade Statamic CMS to version 5.73.11 or 6.4.0 or later, where the vulnerability has been patched. Review and restrict control panel permissions rigorously, ensuring only trusted users have the ability to configure fields, edit entries, or modify form settings that enable Antlers templates. Audit third-party addons for Antlers-enabled inputs and verify compatibility with patched Statamic versions. Implement strong authentication mechanisms such as multi-factor authentication (MFA) to reduce the risk of credential compromise. Regularly monitor CMS logs for suspicious activity related to template editing or configuration changes. Conduct security training for administrators to recognize the risks of granting excessive permissions. If immediate patching is not feasible, consider disabling Antlers template processing on user-controllable inputs where possible or limiting access to these features. Employ web application firewalls (WAFs) with custom rules to detect and block unusual template injection patterns. Finally, maintain regular backups and incident response plans to recover quickly in case of compromise.