Is statamic/cms 6.24 vulnerable?
Composer · 3 releases from 6.24.0 to 6.24.2 · latest statamic/cms is 6.39.0 · checked 2 Nov 2026
Yes: 1 known advisory
Yes. statamic/cms 6.24.2, the last 6.24 release, is affected by 1 known security advisory (1 medium), including CVE-2026-71293. 2 more affect earlier 6.24.x releases. At least one has no fixed release yet.
Advisories affecting statamic/cms 6.24.2
Statamic CMS exposes two-factor recovery codes through dynamic Antlers rendering
- Affected
- >=6.0.0-alpha.1 <=6.30.0
- Fixed in
- No fix released
Fixed within 6.24.x, affecting earlier releases
Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template
- Affected
- <5.74.3 · >=6.0.0 <6.24.2
- Fixed in
- 5.74.3, 6.24.2
Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types
- Affected
- <5.74.3 · >=6.0.0 <6.24.2
- Fixed in
- 5.74.3, 6.24.2
Which of your client projects are still on statamic/cms 6.24?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact statamic/cms version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other statamic/cms versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.