CVE-2026-49287 is a vulnerability in Statamic CMS involving unsafe reflection due to externally-controlled input used in selecting classes or code during in-memory collection sorting. The prior fix for CVE-2026-41175 addressed the query builder but did not cover sorting, allowing manipulation of sort parameters to cause content and asset loss. Exploitation requires a front-end template that passes user input into sorting parameters, which is not the default configuration. The issue is resolved in Statamic CMS versions 5.73.23 and 6.20.0.

The vulnerability can result in loss of content and assets if exploited. However, exploitation is not straightforward as it requires a specific template setup that passes visitor-controlled input into sorting parameters. There is no indication of confidentiality or availability impact beyond content and asset loss. No known exploits in the wild have been reported.

Upgrade Statamic CMS to version 5.73.23 or later, or 6.20.0 or later, where this vulnerability has been fixed. Since the vulnerability requires explicit template configuration to be exploitable, review and avoid passing untrusted user input into sorting parameters in templates as a preventive measure.