CVE-2026-44306

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, the default ("automagic") form notification email rendered user-submitted values without escaping, allowing an unauthenticated form submitter to inject HTML into the notification emails sent to the configured recipients. This issue is fixed in versions 5.74.3 and 6.24.2.

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, public frontend forms did not enforce the file upload restrictions that the Control Panel enforces, so an unauthenticated visitor could upload file types an administrator had intended to disallow through a form's assets or files field, and for assets fields, files could be stored on a public, web-accessible disk, though the application's global upload allowlist still blocked executable types such as .php and .html. This issue is fixed in versions 5.74.3 and 6.24.2.

Statamic before versions 5.74.1 and 6.24.0, when OAuth login is enabled with a provider that does not guarantee verified email addresses, allows an unauthenticated attacker to sign in as an existing user, including a super admin, without knowing the password. This is because the application matches OAuth identities to accounts by email address alone. The issue is fixed in versions 5.74.1 and 6.24.0.

In Statamic prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belonged to an existing user, without having permission to view users, though the endpoint only exposed user existence and not any other user data.

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, manipulating user-supplied input incorporated into Antlers templates could result in the loss of content and assets, on sites whose templates pass untrusted input into affected areas, and exploitation did not require authentication. This issue is fixed in versions 5.74.1 and 6.24.0.

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could view content from entries they did not have permission to view, including entry content and custom field values, from any collection and including unpublished entries, through the navigation endpoint, though no data could be modified. This issue is fixed in versions 5.74.1 and 6.24.0.

Statamic CMS prior to versions 5.73.24 and 6.20.1 does not neutralize spreadsheet formula characters in CSV export. Form submission values starting with characters like =, +, -, or @ can be interpreted as live formulas when the file is opened in a spreadsheet application. The attack can be carried out by an unauthenticated front-end user and then triggered by an editor opening the export.

Statamic before versions 5.73.24 and 6.20.1 contains a server-side request forgery (SSRF) vulnerability in the Glide image proxy. URL validation in `RemoteUrlValidator.php` and `GuzzleAdapter.php` can be bypassed via DNS rebinding. The hostname is first validated as publicly routable, but when the image is fetched, DNS is resolved again, allowing an attacker to rebind to an internal address after validation and make requests to internal resources, including loopback, private network, and cloud metadata endpoints.

Statamic prior to versions 5.73.22 and 6.18.1 contains a vulnerability in the Glide image proxy. URL validation could be bypassed, allowing an unauthenticated attacker to make HTTP requests to internal addresses (loopback, private network, cloud metadata).

Statamic (a Laravel and Git powered CMS) prior to 5.73.16 and 6.7.2 allows authenticated Control Panel users to view entry revisions for any collection with revisions enabled, regardless of collection permissions. This bypasses authorization checks enforced by the main entry controllers, exposing entry field values and blueprint data. Users could also create entry revisions without edit permission, though this only snapshots existing content state. Fixed in 5.73.16 and 6.7.2.