PHP package security
Is statamic/cms vulnerable?
44 known security advisories for statamic/cms. The latest was reported on 2026-08-06 and is fixed in 5.74.3 and 6.24.2. The newest release, 6.40.0, is not affected by any of them.
1 critical 15 high 25 medium 3 low
- Known advisories
- 44
- Newest release
- 6.40.0
- Released
- 2026-11-03
- Affecting newest release
- 0
- Last synced
- 2026-11-03
Check your version
Security advisories for statamic/cms
| Reported | Advisory | Severity | Affected | Fixed in |
|---|---|---|---|---|
| 2026-08-06 | Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template GHSA-vx89-p3j7-8xqc · CVE-2026-71435 · GitHub | medium | >=6.0.0,<6.24.2 | <5.74.3 | 5.74.3, 6.24.2 |
| 2026-08-06 | Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types GHSA-qhr7-v3xp-vw9m · CVE-2026-71434 · GitHub | medium | >=6.0.0,<6.24.2 | <5.74.3 | 5.74.3, 6.24.2 |
| 2026-08-06 | Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries GHSA-qh8c-7588-qfrv · CVE-2026-64662 · GitHub | medium | >=6.0.0,<6.24.0 | <5.74.1 | 5.74.1, 6.24.0 |
| 2026-08-06 | Statamic: Unsafe method invocation via Antlers template resolution allows data destruction GHSA-j2vp-f2pv-5rj4 · CVE-2026-64663 · GitHub | medium | >=6.0.0,<6.24.0 | <5.74.1 | 5.74.1, 6.24.0 |
| 2026-08-06 | Statamic: Account takeover via OAuth email matching without email-verification check GHSA-93qh-5269-9wcf · CVE-2026-64665 · GitHub | high | >=6.0.0,<6.24.0 | <5.74.1 | 5.74.1, 6.24.0 |
| 2026-08-06 | Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence GHSA-225x-3jhx-wh4q · CVE-2026-64664 · GitHub | medium | >=6.0.0,<6.24.0 | <5.74.1 | 5.74.1, 6.24.0 |
| 2026-08-05 | Statamic CMS exposes two-factor recovery codes through dynamic Antlers rendering GHSA-jppw-r5j3-xf7x · CVE-2026-71293 · GitHub | medium | >=6.0.0-alpha.1,<=6.30.0 | not stated |
| 2026-06-26 | Statamic CMS's incorrect authorization lets view-only users submit Live Preview content reserved for editors GHSA-7mqq-4v55-88gh · CVE-2026-54244 · GitHub | low | >=6.0.0,<6.20.3 | <5.74.0 | 5.74.0, 6.20.3 |
| 2026-06-26 | Statamic Vulnerable to CSV formula injection in form submission exports GHSA-h77m-qrj7-jxcw · CVE-2026-54243 · GitHub | medium | <5.73.24 | >=6.0.0,<6.20.1 | 5.73.24, 6.20.1 |
| 2026-06-26 | Statamic Vulnerable to Server-Side Request Forgery via Glide (DNS rebinding) GHSA-v5c4-wcpj-x73m · CVE-2026-54242 · GitHub | medium | >=6.0.0,<6.20.1 | <5.73.24 | 5.73.24, 6.20.1 |
| 2026-06-26 | Statamic CMS's unsafe method invocation via collection sorting allows data destruction GHSA-m92m-r54r-x8r2 · CVE-2026-49287 · GitHub | high | >=6.0.0,<6.20.0 | <5.73.23 | 5.73.23, 6.20.0 |
| 2026-06-26 | Statamic CMS: Missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources GHSA-2497-6pwj-pwg7 · CVE-2026-49288 · GitHub | medium | >=6.0.0,<6.20.0 | <5.73.23 | 5.73.23, 6.20.0 |
| 2026-05-18 | Statamic CMS: Server-Side Request Forgery via Glide GHSA-pf9c-ch8r-2958 · CVE-2026-45660 · GitHub | medium | >=6.0.0-alpha.1,<6.18.1 | <5.73.22 | 5.73.22, 6.18.1 |
| 2026-05-06 | Statamic CMS vulnerable to email enumeration via forgot password endpoint GHSA-m24v-f7g5-gq67 · CVE-2026-44306 · GitHub | medium | >=6.0.0,<6.15.0 | <5.73.21 | 5.73.21, 6.15.0 |
| 2026-04-16 | Statamic: Unsafe method invocation via query value resolution allows data destruction GHSA-4jjr-vmv7-wh4w · CVE-2026-41175 · GitHub | high | >=6.0.0-alpha.1,<6.13.0 | <5.73.20 | 5.73.20, 6.13.0 |
| 2026-03-26 | Statamic allows unauthorized content access through missing authorization in its revision controllers GHSA-4hp7-3wxg-cv9q · CVE-2026-33887 · GitHub | medium | >=6.0.0-alpha.1,<6.7.2 | <5.73.16 | 5.73.16, 6.7.2 |
| 2026-03-26 | Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields GHSA-gcqf-5x9f-hq7f · CVE-2026-33886 · GitHub | medium | >=6.5.0,<6.7.2 | >=5.73.12,<5.73.16 | 5.73.16, 6.7.2 |
| 2026-03-26 | Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential GHSA-7f74-7q5w-hj4r · CVE-2026-33885 · GitHub | medium | >=6.0.0.alpha.1,<6.7.2 | <5.73.16 | 5.73.16, 6.7.2 |
| 2026-03-26 | Statamic's live preview token bypasses content protection for unrelated entries GHSA-8vwx-ccf6-5wg2 · CVE-2026-33884 · GitHub | medium | >=6.0.0-alpha.1,<6.7.2 | <5.73.16 | 5.73.16, 6.7.2 |
| 2026-03-26 | Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag GHSA-3jg4-p23x-p4qx · CVE-2026-33883 · GitHub | medium | >=6.0.0-alpha.1,<6.7.2 | <5.73.16 | 5.73.16, 6.7.2 |
| 2026-03-26 | Statamic's Markdown preview endpoint exposes sensitive user data GHSA-cvh3-23vq-w7h4 · CVE-2026-33882 · GitHub | medium | >=6.0.0-alpha.1,<6.7.2 | <5.73.16 | 5.73.16, 6.7.2 |
| 2026-03-18 | Statamic is missing authorization check on taxonomy term creation via fieldtype GHSA-wh3h-gvc4-cc2g · CVE-2026-33177 · GitHub | medium | <5.73.14 | >=6.0.0-alpha.1,<6.7.0 | 5.73.14, 6.7.0 |
| 2026-03-18 | Statamic has a path traversal in file dictionary fieldtype GHSA-qm7r-wwq7-6f85 · CVE-2026-33171 · GitHub | medium | <5.73.14 | >=6.0.0-alpha.1,<6.7.0 | 5.73.14, 6.7.0 |
| 2026-03-18 | Statamic has Stored XSS via SVG Sanitization Bypass GHSA-7rcv-55mj-chg7 · CVE-2026-33172 · GitHub | high | <5.73.14 | >=6.0.0-alpha.1,<6.7.0 | 5.73.14, 6.7.0 |
| 2026-03-13 | Statamic vulnerable to privilege escalation via stored cross-site scripting GHSA-hcch-w73c-jp4m · CVE-2026-32612 · GitHub | medium | >=6.0.0,<6.6.2 | 6.6.2 |
| 2026-03-01 | Statamic vulnerable to privilege escalation via stored cross-site scripting GHSA-5vrj-wf7v-5wr7 · CVE-2026-28426 · GitHub | high | >=6.0.0-alpha.1,<6.4.0 | <5.73.11 | 5.73.11, 6.4.0 |
| 2026-03-01 | Statamic vulnerable to remote code execution via Antlers-enabled control panel inputs GHSA-cpv7-q2wx-m8rw · CVE-2026-28425 · GitHub | high | >=6.0.0-alpha.1,<6.7.2 | <5.73.16 | 5.73.16, 6.7.2 |
| 2026-03-01 | Statamic's missing authorization allows access to email addresses GHSA-w878-f8c6-7r63 · CVE-2026-28424 · GitHub | medium | >=6.0.0-alpha.1,<6.4.0 | <5.73.11 | 5.73.11, 6.4.0 |
| 2026-03-01 | Statamic Vulnerable to Server-Side Request Forgery via Glide GHSA-cwpp-325q-2cvp · CVE-2026-28423 · GitHub | medium | >=6.0.0-alpha.1,<6.4.0 | <5.73.11 | 5.73.11, 6.4.0 |
| 2026-02-27 | Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass GHSA-rw9x-pxqx-q789 · CVE-2026-27939 · GitHub | high | >=6.0.0,<6.4.0 | 6.4.0 |
| 2026-02-24 | Statamic is vulnerable to account takeover via password reset link injection GHSA-jxq9-79vj-rgvw · CVE-2026-27593 · GitHub | critical | >=6.0.0-alpha.1,<6.7.1 | <5.73.10 | 5.73.10, 6.7.1 |
| 2026-02-19 | Statamic affected by privilege escalation via stored cross-site scripting GHSA-8r7r-f4gm-wcpq · CVE-2026-27196 · GitHub | high | <5.73.9 | >=6.0.0-alpha.1,<6.3.2 | 5.73.9, 6.3.2 |
| 2026-02-11 | Statamic CMS vulnerable to privilege escalation via stored cross-site scripting GHSA-ff9r-ww9c-43x8 · CVE-2026-25759 · GitHub | high | >=6.0.0,<6.2.3 | 6.2.3 |
| 2026-02-11 | Statamic CMS's missing authorization allows access to assets GHSA-gwmx-9gcj-332h · CVE-2026-25633 · GitHub | medium | >=6.0.0-alpha.1,<6.2.5 | <5.73.6 | 5.73.6, 6.2.5 |
| 2025-10-30 | Statamic Vulnerable to Superadmin Account Takeover via Stored Cross-Site Scripting and Lack of Proper X-CSRF-TOKEN Server-Side Validation GHSA-g59r-24g3-h7cm · CVE-2025-64112 · GitHub | high | <=5.22.0 | not stated |
| 2024-11-19 | Statamic CMS has a Path Traversal in Asset Upload GHSA-p7f6-8mcm-fwv3 · CVE-2024-52600 · GitHub | medium | <=5.16.0 | not stated |
| 2024-06-02 | Password confirmation stored in plain text via registration form in statamic/cms GHSA-qvpj-w7xj-r6w9 · CVE-2024-36119 · GitHub | low | >=5.3.0,<5.6.2 | 5.6.2 |
| 2024-02-01 | Statmic CMS vulnerable to account takeover via XSS and password reset link GHSA-vqxq-hvxw-9mv9 · CVE-2024-24570 · GitHub | high | <3.4.17 | >=4.00,<4.46.0 | 3.4.17, 4.46.0 |
| 2023-11-22 | Cross-site Scripting via uploaded assets GHSA-8jjh-j3c2-cjcv · CVE-2023-48701 · GitHub | high | >=4.0.0,<4.36.0 | <3.4.15 | 3.4.15, 4.36.0 |
| 2023-11-14 | Statamic CMS vulnerable to remote code execution via form uploads GHSA-2r53-9295-3m86 · CVE-2023-48217 · GitHub | high | <3.4.14 | >=4.0.0,<4.34.0 | 3.4.14, 4.34.0 |
| 2023-11-12 | Statamic CMS remote code execution via front-end form uploads GHSA-72hg-5wr5-rmfc · CVE-2023-47129 · GitHub | high | <3.4.13 | >=4.0.0,<4.33.0 | 3.4.13, 4.33.0 |
| 2023-07-06 | Statamic's Antlers sanitizer cannot effectively sanitize malicious SVG GHSA-6r5g-cq4q-327g · CVE-2023-36828 · GitHub | medium | <4.10.0 | 4.10.0 |
| 2022-05-13 | Statamic framework Incorrect Permission Assignment GHSA-5m64-9hq5-5pf2 · CVE-2017-11422 · GitHub | high | <2.6.0 | 2.6.0 |
| 2022-03-29 | Discoverability of user password hash in Statamic CMS GHSA-qcgx-7p5f-hxvr · CVE-2022-24784 · GitHub | low | >=3.3.0,<3.3.2 | <3.2.39 | 3.2.39, 3.3.2 |
Need help patching or upgrading? Laskyr does PHP and Laravel security fixes and upgrades. Tell us what you run and we reply with a plan and a price.
Ask about a fixCheck your whole project. Paste your composer.lock and see every installed package with a known advisory. Nothing is stored.
Check composer.lockQuestions about statamic/cms
Does statamic/cms have known vulnerabilities?
Yes. Packagist lists 44 security advisories for statamic/cms (1 critical, 15 high, 25 medium, 3 low severity). The most recent, reported 2026-08-06, is "Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template". The newest release, 6.40.0, is outside every affected range.
Which version of statamic/cms should I run?
The newest stable release is 6.40.0 (published 2026-11-03). The most recent advisory is fixed in 5.74.3 and 6.24.2, so stay on or above the fixed version for your major version. Run composer update statamic/cms, then composer audit to confirm nothing else is flagged.
How do I check if my statamic/cms version is affected?
Run composer show statamic/cms in your project to see the installed version, then enter it in the version check on this page. You can also run composer audit, which reads the same Packagist advisory data for every package in your composer.lock.