CVE-2026-71434 is a vulnerability in Statamic CMS where public frontend forms did not enforce the same file upload restrictions as the Control Panel before versions 5.74.3 and 6.24.2. This allowed unauthenticated visitors to upload files of types that administrators intended to disallow through form asset or file fields. For asset fields, these files could be stored on a public, web-accessible disk. However, the application's global upload allowlist still blocked executable types such as .php and .html. The issue is resolved in versions 5.74.3 and 6.24.2.

An unauthenticated attacker could upload files with disallowed types to the public frontend forms, potentially leading to unauthorized file storage on a public web-accessible disk. While executable files like .php and .html are blocked, the ability to upload other disallowed file types may enable indirect attacks or misuse of the application’s file storage. There is no indication of direct code execution or system compromise from this vulnerability.

Upgrade Statamic CMS to version 5.74.3 or later, or 6.24.2 or later, where this vulnerability is fixed. No other mitigation is indicated or required according to the available data.