Threats tagged 'ghsa-qhr7-v3xp-vw9m'

Statamic CMS versions prior to 5.74.3 and 6.24.2 allowed unauthenticated users to upload file types via public frontend forms that were not properly restricted, bypassing the Control Panel's file upload restrictions. Although executable file types like .php and .html were blocked by a global allowlist, other disallowed file types could be uploaded and stored on a publicly accessible disk. This vulnerability is fixed in versions 5.74.3 and 6.24.2.