Statamic CMS, a Laravel and Git-powered content management system, had a vulnerability (CWE-434) where public frontend forms did not enforce the same file upload restrictions as the Control Panel prior to versions 5.74.3 and 6.24.2. This allowed unauthenticated visitors to upload file types that administrators intended to disallow through form asset or file fields. Uploaded files in asset fields could be stored on a public, web-accessible disk. The global upload allowlist still blocked executable types such as .php and .html, mitigating some risk. The issue is fixed in versions 5.74.3 and 6.24.2.

An unauthenticated attacker could upload files with disallowed types via public frontend forms, potentially leading to unauthorized file uploads stored on publicly accessible disks. While executable files like .php and .html were blocked, the ability to upload other disallowed file types could facilitate further attacks or misuse of the system. There is no indication of direct confidentiality or availability impact, and no known exploits in the wild.

Upgrade Statamic CMS to version 5.74.3 or later, or 6.24.2 or later, where this vulnerability is fixed. No other specific mitigations are indicated. Patch status is confirmed fixed in these versions.