Is statamic/cms 5.74 vulnerable?
Composer · 8 releases from 5.74.0 to 5.74.7 · latest statamic/cms is 6.39.0 · checked 2 Nov 2026
No known advisories in the last release
statamic/cms 5.74.7, the last 5.74 release, has no known advisories. 6 advisories affect earlier 5.74.x releases, so update to 5.74.7.
composer require statamic/cms:^5.74.7Fixed within 5.74.x, affecting earlier releases
Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template
- Affected
- <5.74.3 · >=6.0.0 <6.24.2
- Fixed in
- 5.74.3, 6.24.2
Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types
- Affected
- <5.74.3 · >=6.0.0 <6.24.2
- Fixed in
- 5.74.3, 6.24.2
Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries
- Affected
- <5.74.1 · >=6.0.0 <6.24.0
- Fixed in
- 5.74.1, 6.24.0
Statamic: Unsafe method invocation via Antlers template resolution allows data destruction
- Affected
- <5.74.1 · >=6.0.0 <6.24.0
- Fixed in
- 5.74.1, 6.24.0
Statamic: Account takeover via OAuth email matching without email-verification check
- Affected
- <5.74.1 · >=6.0.0 <6.24.0
- Fixed in
- 5.74.1, 6.24.0
Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence
- Affected
- <5.74.1 · >=6.0.0 <6.24.0
- Fixed in
- 5.74.1, 6.24.0
Which of your client projects are still on statamic/cms 5.74?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact statamic/cms version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other statamic/cms versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.