Statamic
Statamic: vulnerabilidades y CVE
Statamic tiene 44 vulnerabilidades publicadas, 33 de ellas en los últimos 12 meses. 2 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE44
Últimos 12 meses33
Críticas2
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-71435 | Media (6.1) | 0.34% | — | 6 ago 2026 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, the default ("automagic") form notification email rendered user-submitted values without escaping, allowing an… |
| CVE-2026-71434 | Media (5.3) | 0.41% | — | 6 ago 2026 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, public frontend forms did not enforce the file upload restrictions that the Control Panel enforces, so an… |
| CVE-2026-64665 | Alta (8.1) | 0.54% | — | 6 ago 2026 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, when OAuth login was enabled with a provider that does not guarantee verified email addresses, an unauthenticated… |
| CVE-2026-64664 | Media (4.3) | 0.34% | — | 6 ago 2026 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given… |
| CVE-2026-64663 | Media (6.5) | 0.40% | — | 6 ago 2026 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, manipulating user-supplied input incorporated into Antlers templates could result in the loss of content and assets, on… |
| CVE-2026-64662 | Media (6.5) | 0.41% | — | 6 ago 2026 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could view content from entries they did not have permission to view, including… |
| CVE-2026-54244 | Baja (3.5) | 0.30% | — | 17 jul 2026 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.0 and 6.20.3, the Live Preview endpoint for existing entries and terms in src/Http/Controllers/CP/PreviewController.php only checked… |
| CVE-2026-54243 | Media (6.1) | 0.34% | — | 17 jul 2026 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.24 and 6.20.1, form submission values in src/Forms/Exporters/CsvExporter.php were not neutralized for spreadsheet formula characters… |
| CVE-2026-54242 | Media (4.9) | 0.23% | — | 17 jul 2026 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.24 and 6.20.1, the Glide image proxy's URL validation in src/Imaging/RemoteUrlValidator.php and src/Imaging/GuzzleAdapter.php could be… |
| CVE-2026-49288 | Media (4.3) | 0.27% | — | 19 jun 2026 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 and 6.20.0, an authenticated Control Panel user could view metadata and content for resources they don't have permission to view,… |
| CVE-2026-49287 | Alta (7.4) | 0.46% | — | 19 jun 2026 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 and 6.20.0, the fix for CVE-2026-41175 was incomplete. It addressed the issue in the query builder, but the same protection was not… |
| CVE-2026-45660 | Media (5.4) | 0.24% | — | 29 may 2026 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.22 and 6.18.1, the Glide image proxy's URL validation could be bypassed using an IP representation that wasn't normalized before the… |
| CVE-2026-44306 | Media (5.3) | 0.34% | — | 12 may 2026 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.21 and 6.15.0, responses from the forgot password forms hinted at whether an account existed for a given email address. An… |
| CVE-2026-41175 | Alta (8.1) | 0.56% | — | 22 abr 2026 | Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.20 and 6.13.0, manipulating query parameters on Control Panel and REST API endpoints, or arguments in GraphQL queries, could… |
| CVE-2026-33887 | Media (5.4) | 0.24% | — | 27 mar 2026 | Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, authenticated Control Panel users could view entry revisions for any collection with revisions enabled,… |
| CVE-2026-33886 | Media (6.5) | 0.38% | — | 27 mar 2026 | Statamic is a Laravel and Git powered content management system (CMS). Starting in version 5.7.12 and prior to versions 5.73.16 and 6.7.2, a control panel user with access to Antlers-enabled fields could access… |
| CVE-2026-33885 | Media (6.1) | 0.30% | — | 27 mar 2026 | Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, the external URL detection used for redirect validation on unauthenticated endpoints could be bypassed,… |
| CVE-2026-33884 | Media (4.3) | 0.27% | — | 27 mar 2026 | Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, an authenticated Control Panel user with access to live preview could use a live preview token to access… |
| CVE-2026-33883 | Media (6.1) | 0.25% | — | 27 mar 2026 | Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, the `user:reset_password_form` tag could render user-input directly into HTML without escaping, allowing an… |
| CVE-2026-33882 | Media (6.5) | 0.44% | — | 27 mar 2026 | Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, the markdown preview endpoint could be manipulated to return augmented data from arbitrary fieldtypes. With the… |
| CVE-2026-33177 | Media (4.3) | 0.27% | — | 20 mar 2026 | Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, low-privileged Control Panel users could create taxonomy terms by submitting requests to the field action… |
| CVE-2026-33172 | Alta (8.7) | 0.36% | — | 20 mar 2026 | Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, a stored XSS vulnerability in SVG asset reuploads allows authenticated users with asset upload permissions to… |
| CVE-2026-33171 | Media (4.3) | 0.35% | — | 20 mar 2026 | Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, authenticated Control Panel users could read arbitrary `.json`, `.yaml`, and `.csv` files from the server by… |
| CVE-2026-32612 | Media (5.4) | 0.25% | — | 13 mar 2026 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 6.6.2, stored XSS in the control panel color mode preference allows authenticated users with control panel access to inject malicious… |
| CVE-2026-28426 | Media (5.4) | 0.36% | — | 27 feb 2026 | Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, stored XSS vulnerability in svg and icon related components allow authenticated users with appropriate… |
| CVE-2026-28425 | Alta (8) | 0.82% | — | 27 feb 2026 | Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, an authenticated control panel user with access to Antlers-enabled inputs may be able to achieve remote code… |
| CVE-2026-28424 | Media (6.5) | 0.42% | — | 27 feb 2026 | Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, user email addresses were included in responses from the user fieldtype’s data endpoint for control panel… |
| CVE-2026-28423 | Alta (8.6) | 0.47% | — | 27 feb 2026 | Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, when Glide image manipulation is used in insecure mode (which is not the default), the image proxy can be… |
| CVE-2026-27939 | Alta (8.8) | 0.46% | — | 27 feb 2026 | Statmatic is a Laravel and Git powered content management system (CMS). Starting in version 6.0.0 and prior to version 6.4.0, Authenticated Control Panel users may under certain conditions obtain elevated privileges… |
| CVE-2026-27593 | Alta (8.8) | 0.55% | — | 24 feb 2026 | Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 6.3.3 and 5.73.10, an attacker may leverage a vulnerability in the password reset feature to capture a user's token and reset the… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.