statamic/cms Security Advisories for v6.16.0 (13)
-
[MEDIUM] Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template
PKSA-h7t4-kgpy-prgj CVE-2026-71435 GHSA-vx89-p3j7-8xqc
Affected version: >=6.0.0,<6.24.2|<5.74.3
Reported by:
GitHub -
[MEDIUM] Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types
PKSA-htv4-42tq-8d9c CVE-2026-71434 GHSA-qhr7-v3xp-vw9m
Affected version: >=6.0.0,<6.24.2|<5.74.3
Reported by:
GitHub -
[MEDIUM] Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries
PKSA-yprw-4kcc-73cg CVE-2026-64662 GHSA-qh8c-7588-qfrv
Affected version: >=6.0.0,<6.24.0|<5.74.1
Reported by:
GitHub -
[MEDIUM] Statamic: Unsafe method invocation via Antlers template resolution allows data destruction
PKSA-p8hp-2yrt-f2d6 CVE-2026-64663 GHSA-j2vp-f2pv-5rj4
Affected version: >=6.0.0,<6.24.0|<5.74.1
Reported by:
GitHub -
[HIGH] Statamic: Account takeover via OAuth email matching without email-verification check
PKSA-vbqf-w9v5-8bfs CVE-2026-64665 GHSA-93qh-5269-9wcf
Affected version: >=6.0.0,<6.24.0|<5.74.1
Reported by:
GitHub -
[MEDIUM] Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence
PKSA-691k-v8bf-zdg7 CVE-2026-64664 GHSA-225x-3jhx-wh4q
Affected version: >=6.0.0,<6.24.0|<5.74.1
Reported by:
GitHub -
[MEDIUM] Statamic CMS exposes two-factor recovery codes through dynamic Antlers rendering
PKSA-rsd9-mj5m-pj4f CVE-2026-71293 GHSA-jppw-r5j3-xf7x
Affected version: >=6.0.0-alpha.1,<=6.30.0
Reported by:
GitHub -
[LOW] Statamic CMS's incorrect authorization lets view-only users submit Live Preview content reserved for editors
PKSA-9stt-y5w8-fn5y CVE-2026-54244 GHSA-7mqq-4v55-88gh
Affected version: >=6.0.0,<6.20.3|<5.74.0
Reported by:
GitHub -
[MEDIUM] Statamic Vulnerable to CSV formula injection in form submission exports
PKSA-q7zp-ytbf-kmf9 CVE-2026-54243 GHSA-h77m-qrj7-jxcw
Affected version: <5.73.24|>=6.0.0,<6.20.1
Reported by:
GitHub -
[MEDIUM] Statamic Vulnerable to Server-Side Request Forgery via Glide (DNS rebinding)
PKSA-9vds-c3yh-rq22 CVE-2026-54242 GHSA-v5c4-wcpj-x73m
Affected version: >=6.0.0,<6.20.1|<5.73.24
Reported by:
GitHub -
[HIGH] Statamic CMS's unsafe method invocation via collection sorting allows data destruction
PKSA-fhw5-pm86-31ff CVE-2026-49287 GHSA-m92m-r54r-x8r2
Affected version: >=6.0.0,<6.20.0|<5.73.23
Reported by:
GitHub -
[MEDIUM] Statamic CMS: Missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources
PKSA-ykrx-2shq-vs9n CVE-2026-49288 GHSA-2497-6pwj-pwg7
Affected version: >=6.0.0,<6.20.0|<5.73.23
Reported by:
GitHub -
[MEDIUM] Statamic CMS: Server-Side Request Forgery via Glide
PKSA-7fht-jznj-7mgv CVE-2026-45660 GHSA-pf9c-ch8r-2958
Affected version: >=6.0.0-alpha.1,<6.18.1|<5.73.22
Reported by:
GitHub