CVE-2026-71434 Details
Description
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, public frontend forms did not enforce the file upload restrictions that the Control Panel enforces, so an unauthenticated visitor could upload file types an administrator had intended to disallow through a form's assets or files field, and for assets fields, files could be stored on a public, web-accessible disk, though the application's global upload allowlist still blocked executable types such as .php and .html. This issue is fixed in versions 5.74.3 and 6.24.2.
A vulnerability exists in Statamic CMS versions prior to 5.74.3 and 6.24.2, where public frontend forms failed to apply the same file upload restrictions that the Control Panel enforces. This oversight allowed unauthenticated users to upload file types that administrators had intended to block, through a form's assets or files field. For assets fields, uploaded files could be stored on a public, web-accessible disk. Although Statamic's global upload allowlist prevented the upload of executable file types such as .php and .html, the lack of proper validation on frontend forms created a risk of unauthorized file uploads.
Users can upgrade to Statamic versions 5.74.3 or 6.24.2, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 6, 2026CISA-ADP
Assessed Aug 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/statamic/cms/commit/8be7b6c961536d3173ec4e0965d17b1cf820b7ae | [email protected] | Source CodeVendor |
| https://github.com/statamic/cms/pull/14958 | [email protected] | Issue TrackingVendor |
| https://github.com/statamic/cms/releases/tag/v5.74.3 | [email protected] | Release NotesVendor |
| https://github.com/statamic/cms/releases/tag/v6.24.2 | [email protected] | Release NotesVendor |
| https://github.com/statamic/cms/security/advisories/GHSA-qhr7-v3xp-vw9m | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-434 | Unrestricted Upload of File with Dangerous Type | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Statamic | < 5.74.3 (semver) < 6.24.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 7, 2026 | CVE Modified | CISA-ADP |
| Aug 6, 2026 | New CVE Received | [email protected] |