EUVD-2026-38057
GHSA-m92m-r54r-x8r2
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Network-reachable via HTTP without auth or interaction (AV:N/PR:N/UI:N); AC:H because exploitation depends on a non-default template wiring request input into a sort parameter; no confidentiality impact, integrity and availability high due to content/asset destruction.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 and 6.20.0, the fix for CVE-2026-41175 was incomplete. It addressed the issue in the query builder, but the same protection was not applied to in-memory collection sorting. Manipulating sort parameters could result in the loss of content and assets. This requires a front-end template that passes request input into a tag's sort parameter. It is not exploitable by default - a template would need to be explicitly set up to sort by a visitor-controlled value. This has been fixed in 5.73.23 and 6.20.0.
AnalysisAI
Integrity and availability loss in Statamic CMS versions prior to 5.73.23 and 6.20.0 allows remote attackers to destroy content and assets by manipulating sort parameters that flow into in-memory collection sorting. This is an incomplete-fix follow-up to CVE-2026-41175 (CWE-470, unsafe reflection / method invocation), where the original patch covered the query builder but not the in-memory sort path. No public exploit identified at time of analysis and not in CISA KEV; exploitation requires a non-default template configuration that pipes visitor input into a tag's sort parameter.
Technical ContextAI
Statamic is a Laravel- and Git-backed flat-file/CMS framework (cpe:2.3:a:statamic:cms) that exposes Antlers/Blade tag parameters such as a collection's sort argument. CWE-470 (Use of Externally-Controlled Input to Select Classes or Code, aka unsafe reflection) applies here because the sort value is resolved into a method or callable on the underlying Eloquent/Illuminate Collection - when the value is attacker-controlled, the resolution can dispatch unintended methods on model or collection objects, including destructive ones. The earlier fix sanitized the query-builder path (database-level sort), but the same value-resolution logic in the in-memory Collection sort branch was missed, leaving a parallel sink reachable through the same tag parameters.
RemediationAI
Vendor-released patch: upgrade to Statamic 5.73.23 (5.x branch) or 6.20.0 (6.x branch) via Composer (composer update statamic/cms), per the GitHub Security Advisories at https://github.com/statamic/cms/security/advisories/GHSA-m92m-r54r-x8r2 and https://github.com/statamic/cms/security/advisories/GHSA-4jjr-vmv7-wh4w. If you cannot upgrade immediately, audit all Antlers/Blade templates for tag invocations whose sort parameter is bound to request data (e.g. {{ collection sort="{get:sort}" }} or equivalent), and either hard-code the sort column or whitelist it against a fixed allow-list before passing it into the tag - this removes the attacker-controlled sink at the cost of losing dynamic user-driven sort UX on those pages. Additionally, if the REST or GraphQL APIs are enabled without authentication (the higher-risk configuration called out in the related advisory), disable them or place them behind authentication until patched, accepting the trade-off of breaking any integrations that relied on anonymous access.
Cayin CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials. Rated c
Multiple integer underflows in the icmLut_allocate function in International Color Consortium (ICC) Format library (iccl
phpKF CMS 3.00 Beta allows unauthenticated PHP file upload by disguising it as a PNG, then renaming it for execution. Po
Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 an
Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to ex
SQL injection vulnerability in hava_post.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbitr
Unrestricted file upload vulnerability in hava_upload.php in Havalite CMS 1.1.0 and earlier allows remote attackers to e
Cross-site request forgery (CSRF) vulnerability in Ilch CMS allows remote attackers to hijack the authentication of admi
Multiple cross-site scripting (XSS) vulnerabilities in Havalite 1.0.4 and earlier allow remote attackers to inject arbit
A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.
A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.
A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today