statamic/cms Security Advisories for v5.28.0 (16)
-
[HIGH] Statamic: Unsafe method invocation via query value resolution allows data destruction
PKSA-yx2m-bjk3-fnky CVE-2026-41175 GHSA-4jjr-vmv7-wh4w
Affected version: >=6.0.0-alpha.1,<6.13.0|<5.73.20
Reported by:
GitHub -
[MEDIUM] Statamic allows unauthorized content access through missing authorization in its revision controllers
PKSA-yd5q-tqxd-dxfr CVE-2026-33887 GHSA-4hp7-3wxg-cv9q
Affected version: >=6.0.0-alpha.1,<6.7.2|<5.73.16
Reported by:
GitHub -
[MEDIUM] Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential
PKSA-3yh1-q236-qg5b CVE-2026-33885 GHSA-7f74-7q5w-hj4r
Affected version: >=6.0.0.alpha.1,<6.7.2|<5.73.16
Reported by:
GitHub -
[MEDIUM] Statamic's live preview token bypasses content protection for unrelated entries
PKSA-tg1h-vfwx-wzp9 CVE-2026-33884 GHSA-8vwx-ccf6-5wg2
Affected version: >=6.0.0-alpha.1,<6.7.2|<5.73.16
Reported by:
GitHub -
[MEDIUM] Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag
PKSA-ffqw-wkbr-m6bg CVE-2026-33883 GHSA-3jg4-p23x-p4qx
Affected version: >=6.0.0-alpha.1,<6.7.2|<5.73.16
Reported by:
GitHub -
[MEDIUM] Statamic's Markdown preview endpoint exposes sensitive user data
PKSA-8f4x-d8sb-16sq CVE-2026-33882 GHSA-cvh3-23vq-w7h4
Affected version: >=6.0.0-alpha.1,<6.7.2|<5.73.16
Reported by:
GitHub -
[MEDIUM] Statamic is missing authorization check on taxonomy term creation via fieldtype
PKSA-ymb8-dx7z-7137 CVE-2026-33177 GHSA-wh3h-gvc4-cc2g
Affected version: <5.73.14|>=6.0.0-alpha.1,<6.7.0
Reported by:
GitHub -
[MEDIUM] Statamic has a path traversal in file dictionary fieldtype
PKSA-4mnq-vkqt-4wqf CVE-2026-33171 GHSA-qm7r-wwq7-6f85
Affected version: <5.73.14|>=6.0.0-alpha.1,<6.7.0
Reported by:
GitHub -
[HIGH] Statamic has Stored XSS via SVG Sanitization Bypass
PKSA-8wnz-z9p8-kd44 CVE-2026-33172 GHSA-7rcv-55mj-chg7
Affected version: <5.73.14|>=6.0.0-alpha.1,<6.7.0
Reported by:
GitHub -
[HIGH] Statamic vulnerable to privilege escalation via stored cross-site scripting
PKSA-81wb-3yhb-txs4 CVE-2026-28426 GHSA-5vrj-wf7v-5wr7
Affected version: >=6.0.0-alpha.1,<6.4.0|<5.73.11
Reported by:
GitHub -
[HIGH] Statamic vulnerable to remote code execution via Antlers-enabled control panel inputs
PKSA-skzr-by55-tmc5 CVE-2026-28425 GHSA-cpv7-q2wx-m8rw
Affected version: >=6.0.0-alpha.1,<6.7.2|<5.73.16
Reported by:
GitHub -
[MEDIUM] Statamic's missing authorization allows access to email addresses
PKSA-hycr-3628-cp88 CVE-2026-28424 GHSA-w878-f8c6-7r63
Affected version: >=6.0.0-alpha.1,<6.4.0|<5.73.11
Reported by:
GitHub -
[MEDIUM] Statamic Vulnerable to Server-Side Request Forgery via Glide
PKSA-n7ys-rxzm-bn18 CVE-2026-28423 GHSA-cwpp-325q-2cvp
Affected version: >=6.0.0-alpha.1,<6.4.0|<5.73.11
Reported by:
GitHub -
[CRITICAL] Statamic is vulnerable to account takeover via password reset link injection
PKSA-w3y4-x9d3-9t28 CVE-2026-27593 GHSA-jxq9-79vj-rgvw
Affected version: >=6.0.0-alpha.1,<6.7.1|<5.73.10
Reported by:
GitHub -
[HIGH] Statamic affected by privilege escalation via stored cross-site scripting
PKSA-vfrr-bp4n-314v CVE-2026-27196 GHSA-8r7r-f4gm-wcpq
Affected version: <5.73.9|>=6.0.0-alpha.1,<6.3.2
Reported by:
GitHub -
[MEDIUM] Statamic CMS's missing authorization allows access to assets
PKSA-nr63-r5tp-xby1 CVE-2026-25633 GHSA-gwmx-9gcj-332h
Affected version: >=6.0.0-alpha.1,<6.2.5|<5.73.6
Reported by:
GitHub