What is the CVSS score of CVE-2026-28425?

CVE-2026-28425 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Statamic are affected by CVE-2026-28425?

A high-severity vulnerability in Statmatic CMS could allow authenticated users with specific permissions to execute malicious code on our systems.. A patch is available.

How to fix or mitigate CVE-2026-28425?

Within 24 hours: Inventory all Statmatic installations and verify current versions against 5.73.11 and 6.4.0. Within 7 days: Apply available patches to all affected instances and validate successful deployment. Within 30 days: Conduct access reviews to limit control panel permissions, implement audit logging for Antlers-enabled inputs, and perform security testing to confirm remediation.

Statamic CVE-2026-28425

HIGH

Code Injection (CWE-94)

2026-02-27 security-advisories@github.com

GHSA-cpv7-q2wx-m8rw

RCE Code Injection Statamic

8.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.0 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 25, 2026 - 21:16 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 27, 2026 - 23:16 nvd

HIGH 8.0

DescriptionGitHub Advisory

Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, an authenticated control panel user with access to Antlers-enabled inputs may be able to achieve remote code execution in the application context. That can lead to full compromise of the application, including access to sensitive configuration, modification or exfiltration of data, and potential impact on availability. Exploitation is only possible where Antlers runs on user-controlled content-for example, content fields with Antlers explicitly enabled (requiring permission to configure fields and to edit entries), built-in config that supports Antlers such as Forms email notification settings (requiring configuration permission), or third-party addons that add Antlers-enabled fields to entries (for example, the SEO Pro addon). In each case the attacker must have the relevant control panel permissions. This has been fixed in 5.73.11 and 6.4.0. Users of addons that depend on Statamic should ensure that after updating they are running a patched Statamic version.

AnalysisAI

Remote code execution in Statmatic CMS versions prior to 5.73.11 and 6.4.0 allows authenticated users with control panel access and permission to modify Antlers-enabled fields to execute arbitrary code in the application context. An attacker exploiting this vulnerability can fully compromise the application, including stealing sensitive configuration data, modifying or exfiltrating user data, and disrupting availability. A patch is available and exploitation requires authenticated access with specific field configuration permissions.

Technical ContextAI

Classified as CWE-94 (Code Injection). Affects Statamic. Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, an authenticated control panel user with access to Antlers-enabled inputs may be able to achieve remote code execution in the application context. That can lead to full compromise of the application, including access to sensitive configuration, modification or exfiltration of data, and potential impact on availability. Exploitation is only possible where Antlers runs on user-controlled co