CVE-2026-64663

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, manipulating user-supplied input incorporated into Antlers templates could result in the loss of content and assets, on sites whose templates pass untrusted input into affected areas, and exploitation...

Statamic: Unsafe method invocation via Antlers template resolution allows data destruction

Impact Manipulating user-supplied input incorporated into Antlers templates could result in the loss of content and assets. Exploitation requires a site to have templates that pass untrusted input into affected areas. It does not require authentication. Patches This has been fixed in 5.74.1 and...

GHSA-J2VP-F2PV-5RJ4 Statamic: Unsafe method invocation via Antlers template resolution allows data destruction

Impact Manipulating user-supplied input incorporated into Antlers templates could result in the loss of content and assets. Exploitation requires a site to have templates that pass untrusted input into affected areas. It does not require authentication. Patches This has been fixed in 5.74.1 and...

CVE-2026-64663

Statamic (a Laravel/Git-based CMS) contains a vulnerability (CVE-2026-64663) affecting Antlers templates. Prior to versions 5.74.1 and 6.24.0, if user-supplied input is incorporated into Antlers templates, it could lead to loss of content and assets on sites where templates pass untrusted input i...

CVE-2026-64663 Statamic: Unsafe method invocation via Antlers template resolution allows data destruction

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, manipulating user-supplied input incorporated into Antlers templates could result in the loss of content and assets, on sites whose templates pass untrusted input into affected areas, and exploitation...

GHSA-JPPW-R5J3-XF7X Statamic CMS exposes two-factor recovery codes through dynamic Antlers rendering

Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the twofactorrecoverycodes handle that returns the user's raw two-factor recovery codes with no access restriction: if $handle === 'twofactorrecoverycodes' return new...

CVE-2026-71293

Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the handle that returns the user's raw two-factor recovery codes with no access restriction...

CVE-2026-71293 Statamic CMS Unguarded Exposure of 2FA Recovery Codes via Antlers current_user Variable

Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the handle that returns the user's raw two-factor recovery codes with no access restriction...

CVE-2026-71293

CVE-2026-71293 (Statamic CMS) : The AugmentedUser::get() handler exposes a dedicated case for the two_factor_recovery_codes handle, returning raw 2FA recovery codes without access restrictions. This bypass is not mitigated by password-hash exclusions, and two_factor_recovery_codes is not protecte...

EUVD-2026-53378

Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the twofactorrecoverycodes handle that returns the user's raw two-factor recovery codes with no access restriction: if $handle === 'twofactorrecoverycodes' return new...

CVE-2026-71293 Statamic CMS Unguarded Exposure of 2FA Recovery Codes via Antlers current_user Variable

Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the handle that returns the user's raw two-factor recovery codes with no access restriction...

Remote Code Execution (RCE)

statamic/cms is vulnerable to Remote Code Execution RCE. The vulnerability is due to unsafe execution of user-controlled Antlers template content in Antlers-enabled inputs, which allows an attacker with authenticated control panel access to execute arbitrary code in the application context...

CVE-2026-33886

Statamic is a Laravel and Git powered content management system CMS. Starting in version 5.7.12 and prior to versions 5.73.16 and 6.7.2, a control panel user with access to Antlers-enabled fields could access sensitive application configuration values by inserting config variables into their...

CVE-2026-33886

Statamic is a Laravel and Git powered content management system CMS. Starting in version 5.7.12 and prior to versions 5.73.16 and 6.7.2, a control panel user with access to Antlers-enabled fields could access sensitive application configuration values by inserting config variables into their...

CVE-2026-33886 Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields

Statamic is a Laravel and Git powered content management system CMS. Starting in version 5.7.12 and prior to versions 5.73.16 and 6.7.2, a control panel user with access to Antlers-enabled fields could access sensitive application configuration values by inserting config variables into their...

CVE-2026-33886 Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields

Statamic is a Laravel and Git powered content management system CMS. Starting in version 5.7.12 and prior to versions 5.73.16 and 6.7.2, a control panel user with access to Antlers-enabled fields could access sensitive application configuration values by inserting config variables into their...

CVE-2026-33886

Statamic CMS vulnerability CVE-2026-33886 affects Antlers-enabled content fields. A control panel user could access sensitive configuration values by inserting config variables into content in affected versions: 5.7.12 through 5.73.15 and 6.7.0 through 6.7.1. The issue is fixed in 5.73.16 and 6.7...

CVE-2026-33886 Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields

Statamic is a Laravel and Git powered content management system CMS. Starting in version 5.7.12 and prior to versions 5.73.16 and 6.7.2, a control panel user with access to Antlers-enabled fields could access sensitive application configuration values by inserting config variables into their...

CVE-2026-33886

Statamic is a Laravel and Git powered content management system CMS. Starting in version 5.7.12 and prior to versions 5.73.16 and 6.7.2, a control panel user with access to Antlers-enabled fields could access sensitive application configuration values by inserting config variables into their...

Statamic 信息泄露漏洞

Statamic is a powerful flat-file CMS built using Laravel by Statamic Inc. It allows all content, templates, assets, and settings to be stored in files rather than in a database. Versions of Statamic 5.7.12 to 5.73.16, as well as 6.7.2, had an information leakage vulnerability. This vulnerability...