CVE-2026-71435 Details
Description
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, the default ("automagic") form notification email rendered user-submitted values without escaping, allowing an unauthenticated form submitter to inject HTML into the notification emails sent to the configured recipients. This issue is fixed in versions 5.74.3 and 6.24.2.
A stored cross-site scripting vulnerability has been identified in Statamic CMS versions prior to 5.74.3 and 6.24.2. The issue arises in the default 'automagic' form notification emails, which rendered user-submitted values without proper escaping. This flaw allowed an unauthenticated form submitter to inject HTML into the notification emails sent to recipients.
Users can upgrade to Statamic CMS versions 5.74.3 or 6.24.2 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 6, 2026CISA-ADP
Assessed Aug 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/statamic/cms/commit/4ad1335e818a67249d0617f0f167a1198fb96a2c | [email protected] | Source CodeVendor |
| https://github.com/statamic/cms/pull/14959 | [email protected] | Issue TrackingVendor |
| https://github.com/statamic/cms/releases/tag/v5.74.3 | [email protected] | Release NotesVendor |
| https://github.com/statamic/cms/releases/tag/v6.24.2 | [email protected] | Release NotesVendor |
| https://github.com/statamic/cms/security/advisories/GHSA-vx89-p3j7-8xqc | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Statamic | < 5.74.3 (semver) < 6.24.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 8, 2026 | CVE Modified | CISA-ADP |
| Aug 6, 2026 | New CVE Received | [email protected] |