Security
فارسی
All products

statamic/cms

Composer · Package
44 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Statamic CMS's unsafe method invocation via collection sorting allows data destructionCVE-2026-49287 · GHSA-M92M-R54R-X8R2 statamic/cms Composer High Fix reported
Statamic CMS: Missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resourcesCVE-2026-49288 · GHSA-2497-6PWJ-PWG7 statamic/cms Composer Medium Fix reported
Statamic CMS: Server-Side Request Forgery via GlideCVE-2026-45660 · GHSA-PF9C-CH8R-2958 statamic/cms Composer Medium Fix reported
Statamic Vulnerable to Server-Side Request Forgery via Glide (DNS rebinding)CVE-2026-54242 · GHSA-V5C4-WCPJ-X73M statamic/cms Composer Medium Fix reported
Statamic Vulnerable to CSV formula injection in form submission exportsCVE-2026-54243 · GHSA-H77M-QRJ7-JXCW statamic/cms Composer Medium Fix reported
Statamic CMS's incorrect authorization lets view-only users submit Live Preview content reserved for editorsCVE-2026-54244 · GHSA-7MQQ-4V55-88GH statamic/cms Composer Low Fix reported
Password confirmation stored in plain text via registration form in statamic/cmsCVE-2024-36119 · GHSA-QVPJ-W7XJ-R6W9 statamic/cms Composer Low Fix reported
Statmic CMS vulnerable to account takeover via XSS and password reset linkCVE-2024-24570 · GHSA-VQXQ-HVXW-9MV9 statamic/cms Composer High Fix reported
Statamic CMS remote code execution via front-end form uploadsCVE-2023-47129 · GHSA-72HG-5WR5-RMFC statamic/cms Composer High Fix reported
Statamic CMS vulnerable to remote code execution via form uploadsCVE-2023-48217 · GHSA-2R53-9295-3M86 statamic/cms Composer High Fix reported
Statamic's Antlers sanitizer cannot effectively sanitize malicious SVGCVE-2023-36828 · GHSA-6R5G-CQ4Q-327G statamic/cms Composer Medium Fix reported
Statamic CMS exposes two-factor recovery codes through dynamic Antlers renderingCVE-2026-71293 · GHSA-JPPW-R5J3-XF7X statamic/cms Composer Medium No fix reported
Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email TemplateCVE-2026-71435 · GHSA-VX89-P3J7-8XQC statamic/cms Composer Medium Fix reported
Statamic: Missing file upload validation on frontend forms allows uploading disallowed file typesCVE-2026-71434 · GHSA-QHR7-V3XP-VW9M statamic/cms Composer Medium Fix reported
Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entriesCVE-2026-64662 · GHSA-QH8C-7588-QFRV statamic/cms Composer Medium Fix reported
Statamic: Unsafe method invocation via Antlers template resolution allows data destructionCVE-2026-64663 · GHSA-J2VP-F2PV-5RJ4 statamic/cms Composer Medium Fix reported
Statamic: Account takeover via OAuth email matching without email-verification checkCVE-2026-64665 · GHSA-93QH-5269-9WCF statamic/cms Composer High Fix reported
Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existenceCVE-2026-64664 · GHSA-225X-3JHX-WH4Q statamic/cms Composer Medium Fix reported
Statamic: Unsafe method invocation via query value resolution allows data destructionCVE-2026-41175 · GHSA-4JJR-VMV7-WH4W statamic/cms Composer High Fix reported
Statamic CMS vulnerable to email enumeration via forgot password endpointCVE-2026-44306 · GHSA-M24V-F7G5-GQ67 statamic/cms Composer Medium Fix reported