Log in Start free

Vulnerability · Published Aug 6, 2026 · Assigned by GitHub_M

CVE-2026-71434Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types

Medium 5.3

In plain English

A medium-severity unrestricted file upload in cms from statamic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.4%top 64.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, public frontend forms did not enforce the file upload restrictions that the Control Panel enforces, so an unauthenticated visitor could upload file types an administrator had intended to disallow through a form's assets or files field, and for assets fields, files could be stored on a public, web-accessible disk, though the application's global upload allowlist still blocked executable types such as .php and .html. This issue is fixed in versions 5.74.3 and 6.24.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagiststatamic/cms5.74.3GHSA-qhr7-v3xp-vw9m
Packagiststatamic/cms6.24.2GHSA-qhr7-v3xp-vw9m

Affected products (as reported)

VendorProductVersions
statamic cms < 5.74.3>= 6.0.0, < 6.24.2

Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References