statamic/cms vulnerabilities
The Statamic CMS Core Package
- Registry
- Composer
- Latest
- 6.37.0
- License
- proprietary
44 known advisories
The latest version, 6.37.0, is not affected by any of them. Projects on older versions may be.
composer require statamic/cms:^6.37.0Security advisories for statamic/cms
Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template
- Affected
- <5.74.3 · >=6.0.0 <6.24.2
- Fixed in
- 5.74.3, 6.24.2
Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types
- Affected
- <5.74.3 · >=6.0.0 <6.24.2
- Fixed in
- 5.74.3, 6.24.2
Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries
- Affected
- <5.74.1 · >=6.0.0 <6.24.0
- Fixed in
- 5.74.1, 6.24.0
Statamic: Unsafe method invocation via Antlers template resolution allows data destruction
- Affected
- <5.74.1 · >=6.0.0 <6.24.0
- Fixed in
- 5.74.1, 6.24.0
Statamic: Account takeover via OAuth email matching without email-verification check
- Affected
- <5.74.1 · >=6.0.0 <6.24.0
- Fixed in
- 5.74.1, 6.24.0
Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence
- Affected
- <5.74.1 · >=6.0.0 <6.24.0
- Fixed in
- 5.74.1, 6.24.0
Statamic CMS exposes two-factor recovery codes through dynamic Antlers rendering
- Affected
- >=6.0.0-alpha.1 <=6.30.0
- Fixed in
- No fix released
Statamic CMS's incorrect authorization lets view-only users submit Live Preview content reserved for editors
- Affected
- <5.74.0 · >=6.0.0 <6.20.3
- Fixed in
- 5.74.0, 6.20.3
Statamic Vulnerable to CSV formula injection in form submission exports
- Affected
- >=6.0.0 <6.20.1 · <5.73.24
- Fixed in
- 5.73.24, 6.20.1
Statamic Vulnerable to Server-Side Request Forgery via Glide (DNS rebinding)
- Affected
- <5.73.24 · >=6.0.0 <6.20.1
- Fixed in
- 5.73.24, 6.20.1
Statamic CMS's unsafe method invocation via collection sorting allows data destruction
- Affected
- <5.73.23 · >=6.0.0 <6.20.0
- Fixed in
- 5.73.23, 6.20.0
Statamic CMS: Missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources
- Affected
- <5.73.23 · >=6.0.0 <6.20.0
- Fixed in
- 5.73.23, 6.20.0
Statamic CMS: Server-Side Request Forgery via Glide
- Affected
- <5.73.22 · >=6.0.0-alpha.1 <6.18.1
- Fixed in
- 5.73.22, 6.18.1
Statamic CMS vulnerable to email enumeration via forgot password endpoint
- Affected
- <5.73.21 · >=6.0.0 <6.15.0
- Fixed in
- 5.73.21, 6.15.0
Statamic: Unsafe method invocation via query value resolution allows data destruction
- Affected
- <5.73.20 · >=6.0.0-alpha.1 <6.13.0
- Fixed in
- 5.73.20, 6.13.0
Statamic allows unauthorized content access through missing authorization in its revision controllers
- Affected
- <5.73.16 · >=6.0.0-alpha.1 <6.7.2
- Fixed in
- 5.73.16, 6.7.2
Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields
- Affected
- >=5.73.12 <5.73.16 · >=6.5.0 <6.7.2
- Fixed in
- 5.73.16, 6.7.2
Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential
- Affected
- <5.73.16 · >=6.0.0.alpha.1 <6.7.2
- Fixed in
- 5.73.16, 6.7.2
Statamic's live preview token bypasses content protection for unrelated entries
- Affected
- <5.73.16 · >=6.0.0-alpha.1 <6.7.2
- Fixed in
- 5.73.16, 6.7.2
Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag
- Affected
- <5.73.16 · >=6.0.0-alpha.1 <6.7.2
- Fixed in
- 5.73.16, 6.7.2
Statamic's Markdown preview endpoint exposes sensitive user data
- Affected
- <5.73.16 · >=6.0.0-alpha.1 <6.7.2
- Fixed in
- 5.73.16, 6.7.2
Statamic is missing authorization check on taxonomy term creation via fieldtype
- Affected
- >=6.0.0-alpha.1 <6.7.0 · <5.73.14
- Fixed in
- 5.73.14, 6.7.0
Statamic has a path traversal in file dictionary fieldtype
- Affected
- >=6.0.0-alpha.1 <6.7.0 · <5.73.14
- Fixed in
- 5.73.14, 6.7.0
Statamic has Stored XSS via SVG Sanitization Bypass
- Affected
- >=6.0.0-alpha.1 <6.7.0 · <5.73.14
- Fixed in
- 5.73.14, 6.7.0
Statamic vulnerable to privilege escalation via stored cross-site scripting
- Affected
- >=6.0.0 <6.6.2
- Fixed in
- 6.6.2
Statamic vulnerable to privilege escalation via stored cross-site scripting
- Affected
- <5.73.11 · >=6.0.0-alpha.1 <6.4.0
- Fixed in
- 5.73.11, 6.4.0
Statamic vulnerable to remote code execution via Antlers-enabled control panel inputs
- Affected
- <5.73.16 · >=6.0.0-alpha.1 <6.7.2
- Fixed in
- 5.73.16, 6.7.2
Statamic's missing authorization allows access to email addresses
- Affected
- <5.73.11 · >=6.0.0-alpha.1 <6.4.0
- Fixed in
- 5.73.11, 6.4.0
Statamic Vulnerable to Server-Side Request Forgery via Glide
- Affected
- <5.73.11 · >=6.0.0-alpha.1 <6.4.0
- Fixed in
- 5.73.11, 6.4.0
Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass
- Affected
- >=6.0.0 <6.4.0
- Fixed in
- 6.4.0
Statamic is vulnerable to account takeover via password reset link injection
- Affected
- <5.73.10 · >=6.0.0-alpha.1 <6.7.1
- Fixed in
- 5.73.10, 6.7.1
Statamic affected by privilege escalation via stored cross-site scripting
- Affected
- >=6.0.0-alpha.1 <6.3.2 · <5.73.9
- Fixed in
- 5.73.9, 6.3.2
Statamic CMS vulnerable to privilege escalation via stored cross-site scripting
- Affected
- >=6.0.0 <6.2.3
- Fixed in
- 6.2.3
Statamic CMS's missing authorization allows access to assets
- Affected
- <5.73.6 · >=6.0.0-alpha.1 <6.2.5
- Fixed in
- 5.73.6, 6.2.5
Statamic Vulnerable to Superadmin Account Takeover via Stored Cross-Site Scripting and Lack of Proper X-CSRF-TOKEN Server-Side Validation
- Affected
- <5.22.1
- Fixed in
- 5.22.1
Statamic CMS has a Path Traversal in Asset Upload
- Affected
- <5.17.0
- Fixed in
- 5.17.0
Password confirmation stored in plain text via registration form in statamic/cms
- Affected
- >=5.3.0 <5.6.2
- Fixed in
- 5.6.2
Statmic CMS vulnerable to account takeover via XSS and password reset link
- Affected
- >=4.00 <4.46.0 · <3.4.17
- Fixed in
- 3.4.17, 4.46.0
Cross-site Scripting via uploaded assets
- Affected
- <3.4.15 · >=4.0.0 <4.36.0
- Fixed in
- 3.4.15, 4.36.0
Statamic CMS vulnerable to remote code execution via form uploads
- Affected
- >=4.0.0 <4.34.0 · <3.4.14
- Fixed in
- 3.4.14, 4.34.0
Statamic CMS remote code execution via front-end form uploads
- Affected
- >=4.0.0 <4.33.0 · <3.4.13
- Fixed in
- 3.4.13, 4.33.0
Statamic's Antlers sanitizer cannot effectively sanitize malicious SVG
- Affected
- <4.10.0
- Fixed in
- 4.10.0
Statamic framework Incorrect Permission Assignment
- Affected
- <2.6.0
- Fixed in
- 2.6.0
Discoverability of user password hash in Statamic CMS
- Affected
- <3.2.39 · >=3.3.0 <3.3.2
- Fixed in
- 3.2.39, 3.3.2
Which of your client projects still run an old statamic/cms?
NPMscan reads the composer.lock in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.
Other Composer packages
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the Composer registry.