93 matches found
CVE-2026-27196
Statmatic is a Laravel and Git powered content management system CMS. Versions 5.73.8 and below in addition to 6.0.0-alpha.1 through 6.3.1 have a Stored XSS vulnerability in html fieldtypes which allows authenticated users with field management permissions to inject malicious JavaScript that...
CVE-2026-27196 Statamic affected by privilege escalation via stored Cross-site Scripting
Statmatic is a Laravel and Git powered content management system CMS. Versions 5.73.8 and below in addition to 6.0.0-alpha.1 through 6.3.1 have a Stored XSS vulnerability in html fieldtypes which allows authenticated users with field management permissions to inject malicious JavaScript that...
Statamic 跨站脚本漏洞
Statamic is a powerful flat-file CMS built using Laravel by Statamic Inc. It allows all content, templates, assets, and settings to be stored in files rather than in a database. Versions of Statamic 5.73.8 and earlier, as well as versions 6.0.0-alpha.1 through 6.3.1, had a cross-site scripting...
CVE-2026-25759
CVE-2026-25759 affects Statamic CMS (Laravel/Git-based). From version 6.0.0 up to, but not including, 6.2.3, there is a stored XSS in content titles. An authenticated user with content-creation permissions (and control-panel access) can inject JavaScript that executes for higher-privileged users,...
CVE-2026-25633 Statamic's missing authorization allows access to assets
Statamic is a, Laravel + Git powered CMS designed for building websites. Prior to 5.73.6 and 6.2.5, users without permission to view assets are able are able to download them and view their metadata. Logged-out users and users without permission to access the control panel are unable to take...
Statamic CMS vulnerable to privilege escalation via stored cross-site scripting
Impact Stored XSS vulnerability in content titles allow authenticated users with content creation permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. Malicious user must have an account with control panel access and content creation permissions. This...
Statamic CMS's missing authorization allows access to assets
Impact Users without permission to view assets are able are able to download them and view their metadata. Logged-out users and users without permission to access the control panel are unable to take advantage of this. Patches This has been fixed in 5.73.6 and 6.2.5...
GHSA-GWMX-9GCJ-332H Statamic CMS's missing authorization allows access to assets
Impact Users without permission to view assets are able are able to download them and view their metadata. Logged-out users and users without permission to access the control panel are unable to take advantage of this. Patches This has been fixed in 5.73.6 and 6.2.5...
PT-2025-44441
Name of the Vulnerable Software and Affected Versions Statmatic versions prior to 5.22.1 Description Statmatic is a Laravel and Git powered content management system CMS. Stored cross-site scripting XSS issues exist in Collections and Taxonomies. Authenticated users with content creation...
CVE-2025-60868
The Alt Redirect 1.6.3 addon for Statamic fails to consistently strip query string parameters when the "Query String Strip" feature is enabled. Case variations, encoded keys, and duplicates are not removed, allowing attackers to bypass sanitization. This may lead to cache poisoning, parameter...
EUVD-2024-0740
Malicious code in bioql PyPI...
EUVD-2023-2850
Malicious code in bioql PyPI...
EUVD-2023-2924
Malicious code in bioql PyPI...
EUVD-2024-2152
Malicious code in bioql PyPI...
EUVD-2022-1517
Malicious code in bioql PyPI...
CVE-2023-48701
Statamic CMS is a Laravel and Git powered content management system CMS. Prior to versions 3.4.15 an 4.36.0, HTML files crafted to look like images may be uploaded regardless of mime validation. This is only applicable on front-end forms using the "Forms" feature containing an assets field, or...
CVE-2024-24570
Statamic is a Laravel and Git powered CMS. HTML files crafted to look like jpg files are able to be uploaded, allowing for XSS. This affects the front-end forms with asset fields without any mime type validation, asset fields in the control panel, and asset browser in the control panel...
Directory Traversal
statamic/cms is vulnerable to Directory Traversal. The vulnerability is due to improperly handled filenames in asset uploads, which could allow files to be placed in unintended locations on the server, potentially overriding existing files...
GHSA-P7F6-8MCM-FWV3 Statamic CMS has a Path Traversal in Asset Upload
Assets uploaded with appropriately crafted filenames may result in them being placed in a location different than what was configured. Impact - Affects front-end forms with assets fields. - Affects other places where assets can be uploaded, although users would need upload permissions anyway. -...
Statamic CMS has a Path Traversal in Asset Upload
Assets uploaded with appropriately crafted filenames may result in them being placed in a location different than what was configured. Impact - Affects front-end forms with assets fields. - Affects other places where assets can be uploaded, although users would need upload permissions anyway. -...