statamic/cms (Packagist)
Advisories
79
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 6.24.2 or later clears every advisory below that has a fix.
Upgrade commands
composer
composer require statamic/cms:^6.24.2Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-vx89-p3j7-8xqc Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template |
Medium EPSS 0.34% |
>= 6.0.0, < 6.24.2 | 6.24.2 |
| GHSA-vx89-p3j7-8xqc Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template |
Medium EPSS 0.34% |
< 5.74.3 | 5.74.3 |
| GHSA-qhr7-v3xp-vw9m Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types |
Medium EPSS 0.41% |
< 5.74.3 | 5.74.3 |
| GHSA-qhr7-v3xp-vw9m Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types |
Medium EPSS 0.41% |
>= 6.0.0, < 6.24.2 | 6.24.2 |
| GHSA-qh8c-7588-qfrv Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries |
Medium EPSS 0.41% |
< 5.74.1 | 5.74.1 |
| GHSA-qh8c-7588-qfrv Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries |
Medium EPSS 0.41% |
>= 6.0.0, < 6.24.0 | 6.24.0 |
| GHSA-j2vp-f2pv-5rj4 Statamic: Unsafe method invocation via Antlers template resolution allows data destruction |
Medium EPSS 0.40% |
>= 6.0.0, < 6.24.0 | 6.24.0 |
| GHSA-j2vp-f2pv-5rj4 Statamic: Unsafe method invocation via Antlers template resolution allows data destruction |
Medium EPSS 0.40% |
< 5.74.1 | 5.74.1 |
| GHSA-93qh-5269-9wcf Statamic: Account takeover via OAuth email matching without email-verification check |
High EPSS 0.54% |
< 5.74.1 | 5.74.1 |
| GHSA-93qh-5269-9wcf Statamic: Account takeover via OAuth email matching without email-verification check |
High EPSS 0.54% |
>= 6.0.0, < 6.24.0 | 6.24.0 |
| GHSA-225x-3jhx-wh4q Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence |
Medium EPSS 0.34% |
< 5.74.1 | 5.74.1 |
| GHSA-225x-3jhx-wh4q Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence |
Medium EPSS 0.34% |
>= 6.0.0, < 6.24.0 | 6.24.0 |
| GHSA-jppw-r5j3-xf7x Statamic CMS exposes two-factor recovery codes through dynamic Antlers rendering |
Medium EPSS 0.37% |
>= 6.0.0-alpha.1, <= 6.30.0 | No fix yet |
| GHSA-7mqq-4v55-88gh Statamic CMS's incorrect authorization lets view-only users submit Live Preview content reserved for editors |
Low EPSS 0.30% |
>= 6.0.0, < 6.20.3 | 6.20.3 |
| GHSA-7mqq-4v55-88gh Statamic CMS's incorrect authorization lets view-only users submit Live Preview content reserved for editors |
Low EPSS 0.30% |
< 5.74.0 | 5.74.0 |
| GHSA-h77m-qrj7-jxcw Statamic Vulnerable to CSV formula injection in form submission exports |
Medium EPSS 0.34% |
< 5.73.24 | 5.73.24 |
| GHSA-h77m-qrj7-jxcw Statamic Vulnerable to CSV formula injection in form submission exports |
Medium EPSS 0.34% |
>= 6.0.0, < 6.20.1 | 6.20.1 |
| GHSA-v5c4-wcpj-x73m Statamic Vulnerable to Server-Side Request Forgery via Glide (DNS rebinding) |
Medium EPSS 0.23% |
>= 6.0.0, < 6.20.1 | 6.20.1 |
| GHSA-v5c4-wcpj-x73m Statamic Vulnerable to Server-Side Request Forgery via Glide (DNS rebinding) |
Medium EPSS 0.23% |
< 5.73.24 | 5.73.24 |
| GHSA-2497-6pwj-pwg7 Statamic CMS: Missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources |
Medium EPSS 0.27% |
>= 6.0.0, < 6.20.0 | 6.20.0 |
| GHSA-2497-6pwj-pwg7 Statamic CMS: Missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources |
Medium EPSS 0.27% |
< 5.73.23 | 5.73.23 |
| GHSA-m92m-r54r-x8r2 Statamic CMS's unsafe method invocation via collection sorting allows data destruction |
High EPSS 0.46% |
>= 6.0.0, < 6.20.0 | 6.20.0 |
| GHSA-m92m-r54r-x8r2 Statamic CMS's unsafe method invocation via collection sorting allows data destruction |
High EPSS 0.46% |
< 5.73.23 | 5.73.23 |
| GHSA-pf9c-ch8r-2958 Statamic CMS: Server-Side Request Forgery via Glide |
Medium EPSS 0.15% |
>= 6.0.0-alpha.1, < 6.18.1 | 6.18.1 |
| GHSA-pf9c-ch8r-2958 Statamic CMS: Server-Side Request Forgery via Glide |
Medium EPSS 0.15% |
< 5.73.22 | 5.73.22 |
| GHSA-m24v-f7g5-gq67 Statamic CMS vulnerable to email enumeration via forgot password endpoint |
Medium EPSS 0.21% |
>= 6.0.0, < 6.15.0 | 6.15.0 |
| GHSA-m24v-f7g5-gq67 Statamic CMS vulnerable to email enumeration via forgot password endpoint |
Medium EPSS 0.21% |
< 5.73.21 | 5.73.21 |
| GHSA-4jjr-vmv7-wh4w Statamic: Unsafe method invocation via query value resolution allows data destruction |
High EPSS 0.46% |
< 5.73.20 | 5.73.20 |
| GHSA-4jjr-vmv7-wh4w Statamic: Unsafe method invocation via query value resolution allows data destruction |
High EPSS 0.46% |
>= 6.0.0-alpha.1, < 6.13.0 | 6.13.0 |
| GHSA-4hp7-3wxg-cv9q Statamic allows unauthorized content access through missing authorization in its revision controllers |
Medium EPSS 0.15% |
>= 6.0.0-alpha.1, < 6.7.2 | 6.7.2 |
| GHSA-4hp7-3wxg-cv9q Statamic allows unauthorized content access through missing authorization in its revision controllers |
Medium EPSS 0.15% |
< 5.73.16 | 5.73.16 |
| GHSA-gcqf-5x9f-hq7f Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields |
Medium EPSS 0.23% |
>= 5.73.12, < 5.73.16 | 5.73.16 |
| GHSA-gcqf-5x9f-hq7f Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields |
Medium EPSS 0.23% |
>= 6.5.0, < 6.7.2 | 6.7.2 |
| GHSA-7f74-7q5w-hj4r Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential |
Medium EPSS 0.18% |
>= 6.0.0.alpha.1, < 6.7.2 | 6.7.2 |
| GHSA-7f74-7q5w-hj4r Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential |
Medium EPSS 0.18% |
< 5.73.16 | 5.73.16 |
| GHSA-8vwx-ccf6-5wg2 Statamic's live preview token bypasses content protection for unrelated entries |
Medium EPSS 0.17% |
>= 6.0.0-alpha.1, < 6.7.2 | 6.7.2 |
| GHSA-8vwx-ccf6-5wg2 Statamic's live preview token bypasses content protection for unrelated entries |
Medium EPSS 0.17% |
< 5.73.16 | 5.73.16 |
| GHSA-3jg4-p23x-p4qx Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag |
Medium EPSS 0.15% |
< 5.73.16 | 5.73.16 |
| GHSA-3jg4-p23x-p4qx Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag |
Medium EPSS 0.15% |
>= 6.0.0-alpha.1, < 6.7.2 | 6.7.2 |
| GHSA-cvh3-23vq-w7h4 Statamic's Markdown preview endpoint exposes sensitive user data |
Medium EPSS 0.27% |
>= 6.0.0-alpha.1, < 6.7.2 | 6.7.2 |
| GHSA-cvh3-23vq-w7h4 Statamic's Markdown preview endpoint exposes sensitive user data |
Medium EPSS 0.27% |
< 5.73.16 | 5.73.16 |
| GHSA-wh3h-gvc4-cc2g Statamic is missing authorization check on taxonomy term creation via fieldtype |
Medium EPSS 0.23% |
>= 6.0.0-alpha.1, < 6.7.0 | 6.7.0 |
| GHSA-wh3h-gvc4-cc2g Statamic is missing authorization check on taxonomy term creation via fieldtype |
Medium EPSS 0.23% |
< 5.73.14 | 5.73.14 |
| GHSA-qm7r-wwq7-6f85 Statamic has a path traversal in file dictionary fieldtype |
Medium EPSS 0.36% |
< 5.73.14 | 5.73.14 |
| GHSA-qm7r-wwq7-6f85 Statamic has a path traversal in file dictionary fieldtype |
Medium EPSS 0.36% |
>= 6.0.0-alpha.1, < 6.7.0 | 6.7.0 |
| GHSA-7rcv-55mj-chg7 Statamic has Stored XSS via SVG Sanitization Bypass |
High EPSS 0.33% |
>= 6.0.0-alpha.1, < 6.7.0 | 6.7.0 |
| GHSA-7rcv-55mj-chg7 Statamic has Stored XSS via SVG Sanitization Bypass |
High EPSS 0.33% |
< 5.73.14 | 5.73.14 |
| GHSA-hcch-w73c-jp4m Statamic vulnerable to privilege escalation via stored cross-site scripting |
Medium EPSS 0.24% |
>= 6.0.0, < 6.6.2 | 6.6.2 |
| GHSA-5vrj-wf7v-5wr7 Statamic vulnerable to privilege escalation via stored cross-site scripting |
Medium EPSS 0.29% |
>= 6.0.0-alpha.1, < 6.4.0 | 6.4.0 |
| GHSA-5vrj-wf7v-5wr7 Statamic vulnerable to privilege escalation via stored cross-site scripting |
Medium EPSS 0.29% |
< 5.73.11 | 5.73.11 |
| GHSA-cpv7-q2wx-m8rw Statamic vulnerable to remote code execution via Antlers-enabled control panel inputs |
High EPSS 0.50% |
>= 6.0.0-alpha.1, < 6.7.2 | 6.7.2 |
| GHSA-cpv7-q2wx-m8rw Statamic vulnerable to remote code execution via Antlers-enabled control panel inputs |
High EPSS 0.50% |
< 5.73.16 | 5.73.16 |
| GHSA-w878-f8c6-7r63 Statamic's missing authorization allows access to email addresses |
Medium EPSS 0.27% |
< 5.73.11 | 5.73.11 |
| GHSA-w878-f8c6-7r63 Statamic's missing authorization allows access to email addresses |
Medium EPSS 0.27% |
>= 6.0.0-alpha.1, < 6.4.0 | 6.4.0 |
| GHSA-cwpp-325q-2cvp Statamic Vulnerable to Server-Side Request Forgery via Glide |
High EPSS 0.43% |
< 5.73.11 | 5.73.11 |
| GHSA-cwpp-325q-2cvp Statamic Vulnerable to Server-Side Request Forgery via Glide |
High EPSS 0.43% |
>= 6.0.0-alpha.1, < 6.4.0 | 6.4.0 |
| GHSA-rw9x-pxqx-q789 Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass |
High EPSS 0.43% |
>= 6.0.0, < 6.4.0 | 6.4.0 |
| GHSA-jxq9-79vj-rgvw Statamic is vulnerable to account takeover via password reset link injection |
High EPSS 0.52% |
< 5.73.10 | 5.73.10 |
| GHSA-jxq9-79vj-rgvw Statamic is vulnerable to account takeover via password reset link injection |
High EPSS 0.52% |
>= 6.0.0-alpha.1, < 6.7.1 | 6.7.1 |
| GHSA-8r7r-f4gm-wcpq Statamic affected by privilege escalation via stored cross-site scripting |
Medium EPSS 0.32% |
>= 6.0.0-alpha.1, < 6.3.2 | 6.3.2 |
| GHSA-8r7r-f4gm-wcpq Statamic affected by privilege escalation via stored cross-site scripting |
Medium EPSS 0.32% |
< 5.73.9 | 5.73.9 |
| GHSA-ff9r-ww9c-43x8 Statamic CMS vulnerable to privilege escalation via stored cross-site scripting |
High EPSS 0.34% |
>= 6.0.0, < 6.2.3 | 6.2.3 |
| GHSA-gwmx-9gcj-332h Statamic CMS's missing authorization allows access to assets |
Medium EPSS 0.32% |
< 5.73.6 | 5.73.6 |
| GHSA-gwmx-9gcj-332h Statamic CMS's missing authorization allows access to assets |
Medium EPSS 0.32% |
>= 6.0.0-alpha.1, < 6.2.5 | 6.2.5 |
| GHSA-g59r-24g3-h7cm Statamic Vulnerable to Superadmin Account Takeover via Stored Cross-Site Scripting and Lack of Proper X-CSRF-TOKEN Server-Side Validation |
High EPSS 0.30% |
< 5.22.1 | 5.22.1 |
| GHSA-p7f6-8mcm-fwv3 Statamic CMS has a Path Traversal in Asset Upload |
Medium EPSS 0.58% |
< 5.17.0 | 5.17.0 |
| GHSA-qvpj-w7xj-r6w9 Password confirmation stored in plain text via registration form in statamic/cms |
Low EPSS 0.14% |
>= 5.3.0, < 5.6.2 | 5.6.2 |
| GHSA-vqxq-hvxw-9mv9 Statmic CMS vulnerable to account takeover via XSS and password reset link |
Medium EPSS 0.73% |
< 3.4.17 | 3.4.17 |
| GHSA-vqxq-hvxw-9mv9 Statmic CMS vulnerable to account takeover via XSS and password reset link |
Medium EPSS 0.73% |
>= 4.00, < 4.46.0 | 4.46.0 |
| GHSA-8jjh-j3c2-cjcv Cross-site Scripting via uploaded assets |
Medium EPSS 0.70% |
>= 4.0.0, < 4.36.0 | 4.36.0 |
| GHSA-8jjh-j3c2-cjcv Cross-site Scripting via uploaded assets |
Medium EPSS 0.70% |
< 3.4.15 | 3.4.15 |
| GHSA-2r53-9295-3m86 Statamic CMS vulnerable to remote code execution via form uploads |
High EPSS 1.10% |
< 3.4.14 | 3.4.14 |
| GHSA-2r53-9295-3m86 Statamic CMS vulnerable to remote code execution via form uploads |
High EPSS 1.10% |
>= 4.0.0, < 4.34.0 | 4.34.0 |
| GHSA-72hg-5wr5-rmfc Statamic CMS remote code execution via front-end form uploads |
Critical EPSS 1.12% |
< 3.4.13 | 3.4.13 |
| GHSA-72hg-5wr5-rmfc Statamic CMS remote code execution via front-end form uploads |
Critical EPSS 1.12% |
>= 4.0.0, < 4.33.0 | 4.33.0 |
| GHSA-6r5g-cq4q-327g Statamic's Antlers sanitizer cannot effectively sanitize malicious SVG |
Medium EPSS 0.66% |
< 4.10.0 | 4.10.0 |
| GHSA-5m64-9hq5-5pf2 Statamic framework Incorrect Permission Assignment |
High EPSS 0.87% |
< 2.6.0 | 2.6.0 |
| GHSA-qcgx-7p5f-hxvr Discoverability of user password hash in Statamic CMS |
Low EPSS 1.03% |
< 3.2.39 | 3.2.39 |
| GHSA-qcgx-7p5f-hxvr Discoverability of user password hash in Statamic CMS |
Low EPSS 1.03% |
>= 3.3.0, < 3.3.2 | 3.3.2 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor