MediumGHSA-qhr7-v3xp-vw9mCVE-2026-71434

Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types

Published 6 Aug 2026 · Updated 6 Aug 2026

Affected packages

statamic/cmsComposer
Affected
<5.74.3
Fixed in
5.74.3
Update to the fixed version for your release line, for example:composer require statamic/cms:^5.74.3
statamic/cmsComposer
Affected
>=6.0.0 <6.24.2
Fixed in
6.24.2
Update to the fixed version for your release line, for example:composer require statamic/cms:^6.24.2

Details

Impact

Public frontend forms did not enforce the file upload restrictions that the Control Panel enforces, so an unauthenticated visitor could upload file types an administrator had intended to disallow through a form's assets or files field. For assets fields, files could be stored on a public, web-accessible disk. Statamic's global upload allowlist still applied, so executable types such as .php and .html remained blocked.

Patches

This has been fixed in 5.74.3 and 6.24.2.

Is GHSA-qhr7-v3xp-vw9m in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected statamic/cms, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.