Is statamic/cms 4.27 vulnerable?
Composer · 1 release from 4.27.0 to 4.27.0 · latest statamic/cms is 6.39.0 · checked 2 Nov 2026
Yes: 34 known advisories
Yes. statamic/cms 4.27.0, the last 4.27 release, is affected by 34 known security advisories (1 critical, 11 high, 21 medium, 1 low), including CVE-2026-27593, CVE-2026-64665, CVE-2026-49287. Upgrade to 5.74.3 or later to fix all of them.
composer require statamic/cms:^5.74.3Advisories affecting statamic/cms 4.27.0
Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template
- Affected
- <5.74.3 · >=6.0.0 <6.24.2
- Fixed in
- 5.74.3, 6.24.2
Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types
- Affected
- <5.74.3 · >=6.0.0 <6.24.2
- Fixed in
- 5.74.3, 6.24.2
Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries
- Affected
- <5.74.1 · >=6.0.0 <6.24.0
- Fixed in
- 5.74.1, 6.24.0
Statamic: Unsafe method invocation via Antlers template resolution allows data destruction
- Affected
- <5.74.1 · >=6.0.0 <6.24.0
- Fixed in
- 5.74.1, 6.24.0
Statamic: Account takeover via OAuth email matching without email-verification check
- Affected
- <5.74.1 · >=6.0.0 <6.24.0
- Fixed in
- 5.74.1, 6.24.0
Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence
- Affected
- <5.74.1 · >=6.0.0 <6.24.0
- Fixed in
- 5.74.1, 6.24.0
Statamic CMS's incorrect authorization lets view-only users submit Live Preview content reserved for editors
- Affected
- <5.74.0 · >=6.0.0 <6.20.3
- Fixed in
- 5.74.0, 6.20.3
Statamic Vulnerable to CSV formula injection in form submission exports
- Affected
- >=6.0.0 <6.20.1 · <5.73.24
- Fixed in
- 5.73.24, 6.20.1
Statamic Vulnerable to Server-Side Request Forgery via Glide (DNS rebinding)
- Affected
- <5.73.24 · >=6.0.0 <6.20.1
- Fixed in
- 5.73.24, 6.20.1
Statamic CMS's unsafe method invocation via collection sorting allows data destruction
- Affected
- <5.73.23 · >=6.0.0 <6.20.0
- Fixed in
- 5.73.23, 6.20.0
Statamic CMS: Missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources
- Affected
- <5.73.23 · >=6.0.0 <6.20.0
- Fixed in
- 5.73.23, 6.20.0
Statamic CMS: Server-Side Request Forgery via Glide
- Affected
- <5.73.22 · >=6.0.0-alpha.1 <6.18.1
- Fixed in
- 5.73.22, 6.18.1
Statamic CMS vulnerable to email enumeration via forgot password endpoint
- Affected
- <5.73.21 · >=6.0.0 <6.15.0
- Fixed in
- 5.73.21, 6.15.0
Statamic: Unsafe method invocation via query value resolution allows data destruction
- Affected
- <5.73.20 · >=6.0.0-alpha.1 <6.13.0
- Fixed in
- 5.73.20, 6.13.0
Statamic allows unauthorized content access through missing authorization in its revision controllers
- Affected
- <5.73.16 · >=6.0.0-alpha.1 <6.7.2
- Fixed in
- 5.73.16, 6.7.2
Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential
- Affected
- <5.73.16 · >=6.0.0.alpha.1 <6.7.2
- Fixed in
- 5.73.16, 6.7.2
Statamic's live preview token bypasses content protection for unrelated entries
- Affected
- <5.73.16 · >=6.0.0-alpha.1 <6.7.2
- Fixed in
- 5.73.16, 6.7.2
Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag
- Affected
- <5.73.16 · >=6.0.0-alpha.1 <6.7.2
- Fixed in
- 5.73.16, 6.7.2
Statamic's Markdown preview endpoint exposes sensitive user data
- Affected
- <5.73.16 · >=6.0.0-alpha.1 <6.7.2
- Fixed in
- 5.73.16, 6.7.2
Statamic is missing authorization check on taxonomy term creation via fieldtype
- Affected
- >=6.0.0-alpha.1 <6.7.0 · <5.73.14
- Fixed in
- 5.73.14, 6.7.0
Statamic has a path traversal in file dictionary fieldtype
- Affected
- >=6.0.0-alpha.1 <6.7.0 · <5.73.14
- Fixed in
- 5.73.14, 6.7.0
Statamic has Stored XSS via SVG Sanitization Bypass
- Affected
- >=6.0.0-alpha.1 <6.7.0 · <5.73.14
- Fixed in
- 5.73.14, 6.7.0
Statamic vulnerable to privilege escalation via stored cross-site scripting
- Affected
- <5.73.11 · >=6.0.0-alpha.1 <6.4.0
- Fixed in
- 5.73.11, 6.4.0
Statamic vulnerable to remote code execution via Antlers-enabled control panel inputs
- Affected
- <5.73.16 · >=6.0.0-alpha.1 <6.7.2
- Fixed in
- 5.73.16, 6.7.2
Statamic's missing authorization allows access to email addresses
- Affected
- <5.73.11 · >=6.0.0-alpha.1 <6.4.0
- Fixed in
- 5.73.11, 6.4.0
Statamic Vulnerable to Server-Side Request Forgery via Glide
- Affected
- <5.73.11 · >=6.0.0-alpha.1 <6.4.0
- Fixed in
- 5.73.11, 6.4.0
Statamic is vulnerable to account takeover via password reset link injection
- Affected
- <5.73.10 · >=6.0.0-alpha.1 <6.7.1
- Fixed in
- 5.73.10, 6.7.1
Statamic affected by privilege escalation via stored cross-site scripting
- Affected
- >=6.0.0-alpha.1 <6.3.2 · <5.73.9
- Fixed in
- 5.73.9, 6.3.2
Statamic CMS's missing authorization allows access to assets
- Affected
- <5.73.6 · >=6.0.0-alpha.1 <6.2.5
- Fixed in
- 5.73.6, 6.2.5
Statamic Vulnerable to Superadmin Account Takeover via Stored Cross-Site Scripting and Lack of Proper X-CSRF-TOKEN Server-Side Validation
- Affected
- <5.22.1
- Fixed in
- 5.22.1
Statamic CMS has a Path Traversal in Asset Upload
- Affected
- <5.17.0
- Fixed in
- 5.17.0
Cross-site Scripting via uploaded assets
- Affected
- <3.4.15 · >=4.0.0 <4.36.0
- Fixed in
- 3.4.15, 4.36.0
Statamic CMS vulnerable to remote code execution via form uploads
- Affected
- >=4.0.0 <4.34.0 · <3.4.14
- Fixed in
- 3.4.14, 4.34.0
Statamic CMS remote code execution via front-end form uploads
- Affected
- >=4.0.0 <4.33.0 · <3.4.13
- Fixed in
- 3.4.13, 4.33.0
Which of your client projects are still on statamic/cms 4.27?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact statamic/cms version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other statamic/cms versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.