Statamic vulnerabilities
We track 12 vulnerabilities in Statamic products across 2 products. 12 are rated high or critical, and none are known to be exploited. The most recent was published on August 6, 2026.
Latest Statamic vulnerabilities
- 8.1 High severity
cms: Improper Authentication
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, when OAuth login was enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user, pot
- 7.4 High severity
cms: Use of Externally-Controlled Input to Select Classes or Code
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 and 6.20.0, the fix for CVE-2026-41175 was incomplete. It addressed the issue in the query builder, but the same protection was not applied to in-memory collection sorting.
- 8.1 High severity
cms: Use of Externally-Controlled Input to Select Classes or Code
Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.20 and 6.13.0, manipulating query parameters on Control Panel and REST API endpoints, or arguments in GraphQL queries, could result in the loss of content, assets, an
- 8.7 High severity
cms: Improper Neutralization of Input During Web Page Generation
Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, a stored XSS vulnerability in SVG asset reuploads allows authenticated users with asset upload permissions to bypass SVG sanitization and inject malicio
- 8.0 High severity
cms: Improper Control of Generation of Code
Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, an authenticated control panel user with access to Antlers-enabled inputs may be able to achieve remote code execution in the application context. That
- 8.6 High severity
cms: Server-Side Request Forgery
Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, when Glide image manipulation is used in insecure mode (which is not the default), the image proxy can be abused by an unauthenticated user to make the
- 8.8 High severity
cms: Improper Authentication
Statmatic is a Laravel and Git powered content management system (CMS). Starting in version 6.0.0 and prior to version 6.4.0, Authenticated Control Panel users may under certain conditions obtain elevated privileges without completing the intended verification
- 8.8 High severity
cms: Weak Password Recovery Mechanism for Forgotten Password
Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 6.3.3 and 5.73.10, an attacker may leverage a vulnerability in the password reset feature to capture a user's token and reset the password on their behalf. The attacker m
- 8.7 High severity
cms: Improper Neutralization of Input During Web Page Generation
Statmatic is a Laravel and Git powered content management system (CMS). From 6.0.0 to before 6.2.3, a stored XSS vulnerability in content titles allows authenticated users with content creation permissions to inject malicious JavaScript that executes when view
- 8.0 High severity
cms: Improper Neutralization of Input During Web Page Generation
Statmatic is a Laravel and Git powered content management system (CMS). Stored XSS vulnerabilities in Collections and Taxonomies allow authenticated users with content creation permissions to inject malicious JavaScript that executes when viewed by higher-priv
- 8.8 High severity
cms: Unrestricted Upload of File with Dangerous Type
Statamic is a flat-first, Laravel + Git powered CMS designed for building websites. In affected versions certain additional PHP files crafted to look like images may be uploaded regardless of mime type validation rules. This affects front-end forms using the "
- 9.8 Critical severity
cms: Unrestricted Upload of File with Dangerous Type
Statmic is a core Laravel content management system Composer package. Prior to versions 3.4.13 and 4.33.0, on front-end forms with an asset upload field, PHP files crafted to look like images may be uploaded. This only affects forms using the "Forms" feature a