Statamic CMS versions prior to 5.74.3 and 6.24.2 contain a cross-site scripting (XSS) vulnerability in the default form notification email feature. This vulnerability allows an unauthenticated attacker submitting a form to inject HTML into notification emails sent to recipients. The issue arises because user-submitted values are rendered without proper escaping. Fixed versions 5.74.3 and 6.24.2 address this vulnerability.
Statamic CMS versions prior to 5.74.3 and 6.24.2 allowed unauthenticated users to upload file types via public frontend forms that were not properly restricted, bypassing the Control Panel's file upload restrictions. Although executable file types like .php and .html were blocked by a global allowlist, other disallowed file types could be uploaded and stored on a publicly accessible disk. This vulnerability is fixed in versions 5.74.3 and 6.24.2.
Statamic CMS versions prior to 5.74.1 and 6.24.0 contain an authorization bypass vulnerability allowing authenticated Control Panel users to view content from entries they do not have permission to access, including unpublished entries. The vulnerability does not allow modification of data. This issue is fixed in versions 5.74.1 and 6.24.0.
Statamic CMS versions prior to 5.74.1 and 6.24.0 contain a vulnerability where user-supplied input incorporated into Antlers templates can lead to unsafe reflection. This flaw allows unauthenticated attackers to manipulate templates, potentially causing loss of content and assets. The vulnerability is fixed in versions 5.74.1 and 6.24.0.
Statamic CMS versions prior to 5.74.1 and 6.24.0 contain an improper authentication vulnerability when OAuth login is enabled with providers that do not guarantee verified email addresses. This flaw allows an unauthenticated attacker to sign in as an existing user, including potentially a super admin, without knowing the user's password. The vulnerability arises because the application matches OAuth identities to user accounts solely by email address. This issue is fixed in versions 5.74.1 and 6.24.0.
Statamic CMS versions prior to 5.74.1 and 6.24.0 contain a vulnerability where an authenticated Control Panel user can verify the existence of an email address via a user creation wizard endpoint without having permission to view users. This exposure is limited to user existence information and does not disclose other user data. The issue is fixed in versions 5.74.1 and 6.24.0.
Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the handle that returns the user's raw two-factor recovery codes with no access restriction.
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.24 and 6.20.1, form submission values in src/Forms/Exporters/CsvExporter.php were not neutralized for spreadsheet formula characters when exported to CSV. A submission containing a value beginning with a formula trigger character, such as =, +, -, or @, could be interpreted as a live formula when a Control Panel user opens the export in a spreadsheet application. Form submissions can come from unauthenticated front-end visitors, so the malicious value can be supplied by an anonymous user and is later triggered by an editor opening the export. This issue is fixed in versions 5.73.24 and 6.20.1.
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.24 and 6.20.1, the Glide image proxy's URL validation in src/Imaging/RemoteUrlValidator.php and src/Imaging/GuzzleAdapter.php could be bypassed using DNS rebinding. The remote hostname was validated as publicly routable, but resolved again when the image was actually fetched, so an attacker controlling the hostname's DNS could rebind it to an internal address after validation and cause the server to make HTTP requests to internal addresses, including loopback, private network, and cloud metadata endpoints. This affects sites that pass user-supplied URLs to Glide. This issue is fixed in versions 5.73.24 and 6.20.1.
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.0 and 6.20.3, the Live Preview endpoint for existing entries and terms in src/Http/Controllers/CP/PreviewController.php only checked view authorization, but it accepts and renders caller-supplied field values. A Control Panel user with view but not edit permission could therefore submit content they were not authorized to author and generate a shareable Live Preview URL rendering it. This issue is fixed in versions 5.74.0 and 6.20.3.
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 and 6.20.0, an authenticated Control Panel user could view metadata and content for resources they don't have permission to view, including entries, assets, users, roles, groups, and other configured resources. Depending on the resource, this could expose titles, custom field values, entry content, asset metadata, and the existence of users, roles, and groups. No data could be modified. This has been fixed in 5.73.23 and 6.20.0.
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 and 6.20.0, the fix for CVE-2026-41175 was incomplete. It addressed the issue in the query builder, but the same protection was not applied to in-memory collection sorting. Manipulating sort parameters could result in the loss of content and assets. This requires a front-end template that passes request input into a tag's sort parameter. It is not exploitable by default — a template would need to be explicitly set up to sort by a visitor-controlled value. This has been fixed in 5.73.23 and 6.20.0.
A Server-Side Request Forgery (SSRF) vulnerability exists in Statamic CMS versions prior to 5.73.22 and 6.18.1. The Glide image proxy URL validation could be bypassed using non-normalized IP representations, allowing unauthenticated users to make HTTP requests to internal network addresses, including loopback, private networks, and cloud metadata endpoints. This affects sites that pass user-supplied URLs to Glide. Sites running PHP 8.3 or newer are not affected. The vulnerability has a medium severity with a CVSS score of 5.
Statamic CMS versions prior to 5.73.21 and 6.15.0 have a vulnerability in their forgot password forms that allows unauthenticated attackers to determine if an email address is associated with an account. This user enumeration vulnerability can facilitate further credential-based attacks. The issue is fixed in versions 5.73.21 and 6.15.
CVE-2026-41175 is a high-severity vulnerability in Statamic CMS versions prior to 5.73.20 and 6.13.0 involving unsafe reflection (CWE-470). It allows manipulation of query parameters on Control Panel and REST API endpoints or GraphQL queries to delete content, assets, and user accounts. Exploitation via the Control Panel requires authentication with minimal permissions, while REST and GraphQL API exploitation requires these APIs to be explicitly enabled without authentication. The vulnerability has been fixed in versions 5.73.20 and 6.
Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, authenticated Control Panel users could view entry revisions for any collection with revisions enabled, regardless of whether they had the required collection permissions. This bypasses the authorization checks that the main entry controllers enforce, exposing entry field values and blueprint data. Users could also create entry revisions without edit permission, though this only snapshots the existing content state and does not affect published content. This has been fixed in 5.73.16 and 6.7.2.
Statamic is a Laravel and Git powered content management system (CMS). Starting in version 5.7.12 and prior to versions 5.73.16 and 6.7.2, a control panel user with access to Antlers-enabled fields could access sensitive application configuration values by inserting config variables into their content. This has been fixed in 5.73.16 and 6.7.2.
Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, the external URL detection used for redirect validation on unauthenticated endpoints could be bypassed, allowing users to be redirected to external URLs after actions like form submissions and authentication flows. This has been fixed in 5.73.16 and 6.7.2.
Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, an authenticated Control Panel user with access to live preview could use a live preview token to access restricted content that the token was not intended for. This has been fixed in 5.73.16 and 6.7.2.
Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, the `user:reset_password_form` tag could render user-input directly into HTML without escaping, allowing an attacker to craft a URL that executes arbitrary JavaScript in the victim's browser. This has been fixed in 5.73.16 and 6.7.2.