HighGHSA-72hg-5wr5-rmfcCVE-2023-47129
Statamic CMS remote code execution via front-end form uploads
Published 12 Nov 2023 · Updated 10 Sept 2026
Affected packages
statamic/cmsComposer
- Affected
- >=4.0.0 <4.33.0
- Fixed in
- 4.33.0
Update to the fixed version for your release line, for example:
composer require statamic/cms:^4.33.0statamic/cmsComposer
- Affected
- <3.4.13
- Fixed in
- 3.4.13
Update to the fixed version for your release line, for example:
composer require statamic/cms:^3.4.13Details
Impact
On front-end forms with an asset upload field, PHP files crafted to look like images may be uploaded regardless of mime validation rules. This only affects forms using the "Forms" feature and not just _any_ arbitrary form. This does not affect the control panel.
Patches
It has been patched in 3.4.13 and 4.33.0.
Is GHSA-72hg-5wr5-rmfc in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected statamic/cms, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.