CVE-2026-28423

CVE-2026-28423 affects Statamic CMS. Prior to versions 5.73.11 and 6.4.0, using Glide image manipulation in insecure mode (not default) allows an unauthenticated attacker to leverage the image proxy to cause the server to send HTTP requests to arbitrary URLs, either directly or via the watermark ...

EUVD-2026-9076

Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass...

Incorrect User Management

Overview Affected versions of this package are vulnerable to Incorrect User Management via the session function. An attacker can gain unauthorized access to sensitive operations and escalate privileges by bypassing the intended verification step during authenticated sessions. Remediation Upgrade...

GHSA-RW9X-PXQX-Q789 Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass

Impact Authenticated Control Panel users may under certain conditions obtain elevated privileges without completing the intended verification step. This can allow access to sensitive operations and, depending on the user’s existing permissions, may lead to privilege escalation. Patches This has...

CVE-2026-27939 Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass

Statmatic is a Laravel and Git powered content management system CMS. Starting in version 6.0.0 and prior to version 6.4.0, Authenticated Control Panel users may under certain conditions obtain elevated privileges without completing the intended verification step. This can allow access to sensiti...

CVE-2026-27939

Statmatic is a Laravel and Git powered content management system CMS. Starting in version 6.0.0 and prior to version 6.4.0, Authenticated Control Panel users may under certain conditions obtain elevated privileges without completing the intended verification step. This can allow access to sensiti...

CVE-2026-27939 Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass

Statmatic is a Laravel and Git powered content management system CMS. Starting in version 6.0.0 and prior to version 6.4.0, Authenticated Control Panel users may under certain conditions obtain elevated privileges without completing the intended verification step. This can allow access to sensiti...

CVE-2026-27939 Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass

Statmatic is a Laravel and Git powered content management system CMS. Starting in version 6.0.0 and prior to version 6.4.0, Authenticated Control Panel users may under certain conditions obtain elevated privileges without completing the intended verification step. This can allow access to sensiti...

CVE-2026-27939

CVE-2026-27939 affects Statamic CMS (Laravel/Git powered). From version 6.0.0 up to, but not including, 6.4.0, Authenticated Control Panel users may obtain elevated privileges due to a session verification bypass. This could enable access to sensitive operations depending on user permissions. The...

Statamic security vulnerabilities

Statamic is a powerful flat-file CMS built using Laravel by Statamic Inc. It allows all content, templates, assets, and settings to be stored in files rather than in a database. There were security vulnerabilities in versions prior to Statamic 5.73.11 and 6.4.0, which stemmed from the data endpoi...

Statamic code injection vulnerability

Statamic is a powerful flat-file CMS built using Laravel by Statamic Inc. It allows all content, templates, assets, and settings to be stored in files rather than in a database. Versions of Statamic 5.73.11 and earlier, as well as 6.4.0 and earlier, had a code injection vulnerability. This...

PT-2026-22422

Name of the Vulnerable Software and Affected Versions Statmatic versions prior to 5.73.11 Statmatic versions prior to 6.4.0 Description Statmatic is a content management system. When Glide image manipulation is used in insecure mode, an unauthenticated user can exploit the image proxy to make the...

CMS code issues and vulnerabilities

Cms is a software package developed by Statamic. Versions of CMS prior to 5.73.11 and 6.4.0 contained code-related vulnerabilities. These vulnerabilities occurred when using Glide image processing in an insecure mode. In such cases, the image proxy could be exploited to send HTTP requests to...

CMS authorization issue vulnerability

Cms is a software package developed by Statamic. Versions of CMS from 6.0.0 to 6.4.0 had an authorization issue vulnerability. This vulnerability stemmed from improper permission verification, which could lead to unauthorized privilege escalation...

Statamic cross-site scripting vulnerabilities

Statamic is a powerful flat-file CMS built using Laravel by Statamic Inc. It allows all content, templates, assets, and settings to be stored in files rather than in a database. Versions of Statamic 5.73.11 and earlier, as well as 6.4.0 and earlier, had a cross-site scripting vulnerability. This...

PT-2026-22424

Name of the Vulnerable Software and Affected Versions Statamic versions prior to 5.73.11 and prior to 6.4.0 Description Statamic is a Laravel and Git powered content management system CMS. An authenticated control panel user with access to Antlers-enabled inputs may be able to achieve remote code...

CVE-2026-28425: Improper Control of Generation of Code

Statmatic is a Laravel and Git powered content management system CMS. Prior to versions 5.73.16 and 6.7.2, an authenticated control panel user with access to Antlers-enabled inputs may be able to achieve remote code execution in the application context. That can lead to full compromise of the...

CVE-2026-27593 Statamic is vulnerable to account takeover via password reset link injection

Statmatic is a Laravel and Git powered content management system CMS. Prior to versions 6.3.3 and 5.73.10, an attacker may leverage a vulnerability in the password reset feature to capture a user's token and reset the password on their behalf. The attacker must know the email address of a valid...

CVE-2026-27593 Statamic is vulnerable to account takeover via password reset link injection

Statmatic is a Laravel and Git powered content management system CMS. Prior to versions 6.3.3 and 5.73.10, an attacker may leverage a vulnerability in the password reset feature to capture a user's token and reset the password on their behalf. The attacker must know the email address of a valid...

CVE-2026-27593

Statamic CMS (Laravel/Git-based) is affected by CVE-2026-27593 via a password-reset vulnerability. Prior to versions 6.3.3 and 5.73.10, an attacker who knows a valid account’s email could capture a reset token and reset the password on behalf of the user, who must click the reset link in their em...