Composer statamic/cms has 44 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2023-47129 | Statamic CMS remote code execution via front-end form uploads | high | 8.3 | >=4.0.0 and <4.33.0 or <3.4.13 | 4.33.0, 3.4.13 |
| CVE-2023-48217 | Statamic CMS vulnerable to remote code execution via form uploads | high | 8.8 | >=4.0.0 and <4.34.0 or <3.4.14 | 4.34.0, 3.4.14 |
| CVE-2022-24784 | Discoverability of user password hash in Statamic CMS | low | 3.7 | <3.2.39 or >=3.3.0 and <3.3.2 | 3.2.39, 3.3.2 |
| CVE-2017-11422 | Statamic framework Incorrect Permission Assignment | high | 8.8 | <2.6.0 | 2.6.0 |
| CVE-2024-24570 | Statmic CMS vulnerable to account takeover via XSS and password reset link | high | 8.2 | >=4.00 and <4.46.0 or <3.4.17 | 4.46.0, 3.4.17 |
| CVE-2023-48701 | Cross-site Scripting via uploaded assets | high | 7.5 | <3.4.15 or >=4.0.0 and <4.36.0 | 3.4.15, 4.36.0 |
| CVE-2023-36828 | Statamic's Antlers sanitizer cannot effectively sanitize malicious SVG | medium | 5.5 | <4.10.0 | 4.10.0 |
| CVE-2024-52600 | Statamic CMS has a Path Traversal in Asset Upload | medium | 5.3 | <5.17.0 | 5.17.0 |
| CVE-2026-64665 | Statamic: Account takeover via OAuth email matching without email-verification check | high | 8.1 | <5.74.1 or >=6.0.0 and <6.24.0 | 5.74.1, 6.24.0 |
| CVE-2026-27593 | Statamic is vulnerable to account takeover via password reset link injection | critical | 9.3 | <5.73.10 or >=6.0.0-alpha.1 and <6.7.1 | 5.73.10, 6.7.1 |
| CVE-2026-28425 | Statamic vulnerable to remote code execution via Antlers-enabled control panel inputs | high | 8.0 | <5.73.16 or >=6.0.0-alpha.1 and <6.7.2 | 5.73.16, 6.7.2 |
| CVE-2026-49287 | Statamic CMS's unsafe method invocation via collection sorting allows data destruction | high | 7.4 | <5.73.23 or >=6.0.0 and <6.20.0 | 5.73.23, 6.20.0 |
| CVE-2026-27939 | Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass | high | 8.8 | >=6.0.0 and <6.4.0 | 6.4.0 |
| CVE-2026-28423 | Statamic Vulnerable to Server-Side Request Forgery via Glide | medium | 6.8 | <5.73.11 or >=6.0.0-alpha.1 and <6.4.0 | 5.73.11, 6.4.0 |
| CVE-2026-64662 | Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries | medium | 6.5 | <5.74.1 or >=6.0.0 and <6.24.0 | 5.74.1, 6.24.0 |
| CVE-2026-71434 | Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types | medium | 5.3 | <5.74.3 or >=6.0.0 and <6.24.2 | 5.74.3, 6.24.2 |
| CVE-2026-64663 | Statamic: Unsafe method invocation via Antlers template resolution allows data destruction | medium | 6.5 | <5.74.1 or >=6.0.0 and <6.24.0 | 5.74.1, 6.24.0 |
| CVE-2026-71293 | Statamic CMS exposes two-factor recovery codes through dynamic Antlers rendering | medium | 6.2 | >=6.0.0-alpha.1 and <=6.30.0 | – |
| CVE-2026-33171 | Statamic has a path traversal in file dictionary fieldtype | medium | 4.3 | >=6.0.0-alpha.1 and <6.7.0 or <5.73.14 | 6.7.0, 5.73.14 |
| CVE-2026-64664 | Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence | medium | 4.3 | <5.74.1 or >=6.0.0 and <6.24.0 | 5.74.1, 6.24.0 |
| CVE-2026-25759 | Statamic CMS vulnerable to privilege escalation via stored cross-site scripting | high | 8.7 | >=6.0.0 and <6.2.3 | 6.2.3 |
| CVE-2026-54243 | Statamic Vulnerable to CSV formula injection in form submission exports | medium | 6.1 | >=6.0.0 and <6.20.1 or <5.73.24 | 6.20.1, 5.73.24 |
| CVE-2026-71435 | Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template | medium | 6.1 | <5.74.3 or >=6.0.0 and <6.24.2 | 5.74.3, 6.24.2 |
| CVE-2026-33172 | Statamic has Stored XSS via SVG Sanitization Bypass | high | 8.7 | >=6.0.0-alpha.1 and <6.7.0 or <5.73.14 | 6.7.0, 5.73.14 |
| CVE-2026-27196 | Statamic affected by privilege escalation via stored cross-site scripting | high | 8.1 | >=6.0.0-alpha.1 and <6.3.2 or <5.73.9 | 6.3.2, 5.73.9 |
| CVE-2026-25633 | Statamic CMS's missing authorization allows access to assets | medium | 4.3 | <5.73.6 or >=6.0.0-alpha.1 and <6.2.5 | 5.73.6, 6.2.5 |
| CVE-2025-64112 | Statamic Vulnerable to Superadmin Account Takeover via Stored Cross-Site Scripting and Lack of Proper X-CSRF-TOKEN Server-Side Validation | high | 8.0 | <5.22.1 | 5.22.1 |
| CVE-2026-41175 | Statamic: Unsafe method invocation via query value resolution allows data destruction | high | 8.1 | <5.73.20 or >=6.0.0-alpha.1 and <6.13.0 | 5.73.20, 6.13.0 |
| CVE-2026-54244 | Statamic CMS's incorrect authorization lets view-only users submit Live Preview content reserved for editors | low | 3.5 | <5.74.0 or >=6.0.0 and <6.20.3 | 5.74.0, 6.20.3 |
| CVE-2026-28426 | Statamic vulnerable to privilege escalation via stored cross-site scripting | high | 8.7 | <5.73.11 or >=6.0.0-alpha.1 and <6.4.0 | 5.73.11, 6.4.0 |
| CVE-2026-49288 | Statamic CMS: Missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources | medium | 4.3 | <5.73.23 or >=6.0.0 and <6.20.0 | 5.73.23, 6.20.0 |
| CVE-2026-28424 | Statamic's missing authorization allows access to email addresses | medium | 6.5 | <5.73.11 or >=6.0.0-alpha.1 and <6.4.0 | 5.73.11, 6.4.0 |
| CVE-2026-33882 | Statamic's Markdown preview endpoint exposes sensitive user data | medium | 6.5 | <5.73.16 or >=6.0.0-alpha.1 and <6.7.2 | 5.73.16, 6.7.2 |
| CVE-2026-32612 | Statamic vulnerable to privilege escalation via stored cross-site scripting | medium | 5.4 | >=6.0.0 and <6.6.2 | 6.6.2 |
| CVE-2026-33886 | Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields | medium | 6.5 | >=5.73.12 and <5.73.16 or >=6.5.0 and <6.7.2 | 5.73.16, 6.7.2 |
| CVE-2026-33177 | Statamic is missing authorization check on taxonomy term creation via fieldtype | medium | 4.3 | >=6.0.0-alpha.1 and <6.7.0 or <5.73.14 | 6.7.0, 5.73.14 |
| CVE-2026-54242 | Statamic Vulnerable to Server-Side Request Forgery via Glide (DNS rebinding) | medium | 4.9 | <5.73.24 or >=6.0.0 and <6.20.1 | 5.73.24, 6.20.1 |
| CVE-2026-44306 | Statamic CMS vulnerable to email enumeration via forgot password endpoint | medium | 5.3 | <5.73.21 or >=6.0.0 and <6.15.0 | 5.73.21, 6.15.0 |
| CVE-2026-33885 | Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential | medium | 6.1 | <5.73.16 or >=6.0.0.alpha.1 and <6.7.2 | 5.73.16, 6.7.2 |
| CVE-2026-33884 | Statamic's live preview token bypasses content protection for unrelated entries | medium | 4.3 | <5.73.16 or >=6.0.0-alpha.1 and <6.7.2 | 5.73.16, 6.7.2 |
| CVE-2026-33883 | Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag | medium | 6.1 | <5.73.16 or >=6.0.0-alpha.1 and <6.7.2 | 5.73.16, 6.7.2 |
| CVE-2026-45660 | Statamic CMS: Server-Side Request Forgery via Glide | medium | 5.4 | <5.73.22 or >=6.0.0-alpha.1 and <6.18.1 | 5.73.22, 6.18.1 |
| CVE-2026-33887 | Statamic allows unauthorized content access through missing authorization in its revision controllers | medium | 5.4 | <5.73.16 or >=6.0.0-alpha.1 and <6.7.2 | 5.73.16, 6.7.2 |
| CVE-2024-36119 | Password confirmation stored in plain text via registration form in statamic/cms | low | 1.8 | >=5.3.0 and <5.6.2 | 5.6.2 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# PHP projects (recommended) composer require --dev phpwarden/phpwarden # then vendor/bin/phpwarden deps composer.lock # or, without Composer pipx install phpwarden && phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked