HighGHSA-2r53-9295-3m86CVE-2023-48217
Statamic CMS vulnerable to remote code execution via form uploads
Published 14 Nov 2023 · Updated 10 Sept 2026
Affected packages
statamic/cmsComposer
- Affected
- >=4.0.0 <4.34.0
- Fixed in
- 4.34.0
Update to the fixed version for your release line, for example:
composer require statamic/cms:^4.34.0statamic/cmsComposer
- Affected
- <3.4.14
- Fixed in
- 3.4.14
Update to the fixed version for your release line, for example:
composer require statamic/cms:^3.4.14Details
Impact
Similar to another advisory, certain additional PHP files crafted to look like images may be uploaded regardless of mime type validation rules. This affects front-end forms using the "Forms" feature, and asset upload fields in the control panel.
Patches
It has been patched in 3.4.14 and 4.34.0.
Is GHSA-2r53-9295-3m86 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected statamic/cms, and gives you the command that fixes it.
References
- Linkgithub.com/statamic/cms/security/advisories/GHSA-2r53-9295-3m86
- Advisorynvd.nist.gov/vuln/detail/CVE-2023-48217
- Linkgithub.com/statamic/cms/pull/8991
- Linkgithub.com/statamic/cms/pull/8992
- Linkgithub.com/statamic/cms/commit/4c6fe041e2203a8033e5949ce4a5d9d6c0ad2411
- Linkgithub.com/statamic/cms/commit/da28afde818d605179fbb63b96eabafabad876b6
- Packagegithub.com/statamic/cms
- Linkgithub.com/statamic/cms/releases/tag/v3.4.14
- Linkgithub.com/statamic/cms/releases/tag/v4.34.0
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.