File Upload Vulnerability in Statamic CMS by Statamic
CVE-2026-71434

5.3MEDIUM

Key Information:

Vendor

Statamic

Status
Cms
Vendor
CVE Published:
6 August 2026

What is CVE-2026-71434?

The Statamic CMS, a popular content management system built on Laravel, has a vulnerability that affects file upload functionality. In versions before 5.74.3 and 6.24.2, the system did not properly enforce file upload restrictions on public frontend forms. As a result, unauthenticated users could upload files that administrators had intended to block. Although the application maintained a global upload allowlist that prevented executable file types like .php and .html, users could still exploit this weakness to upload other types of files, potentially exposing sensitive information or harmful content accessible via the web. This issue has been resolved in the subsequent releases, making it crucial for users to upgrade to the latest versions to ensure their site's security.

Affected Version(s)

cms < 5.74.3 < 5.74.3

cms >= 6.0.0, < 6.24.2 < 6.0.0, 6.24.2

References

https://github.com/statamic/cms/security/advisories/GHSA-...
x_refsource_CONFIRM
https://github.com/statamic/cms/pull/14958
x_refsource_MISC
https://github.com/statamic/cms/commit/8be7b6c961536d3173...
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.