What is the CVSS score of CVE-2026-49287?

CVE-2026-49287 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2026-49287?

Within 24 hours: Identify all Statamic instances in production, determine which versions are deployed, and assess which templates accept visitor input for sort operations. Within 7 days: Disable dynamic sort parameters in user-facing content templates; where disabling is infeasible, implement strict input validation and sanitization on sort parameters. Within 30 days: Prepare for upgrade to Statamic 5.73.23 (5.x branch) or 6.20.0 (6.x branch), conduct testing in non-production environments, and execute organization-wide deployment.

Statamic CMS CVE-2026-49287

Q: Which versions of Statamic CMS are affected by CVE-2026-49287?

Statamic CMS versions prior to 5.73.23 (5.x) and 6.20.0 (6.x) are vulnerable to remote content and asset destruction through crafted sort parameters in templates; no public exploit identified at time…. A patch is available.

EUVD-2026-38057 HIGH

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') (CWE-470)

2026-06-19 GitHub_M

GHSA-m92m-r54r-x8r2

Information Disclosure Cms Statamic

7.4

CVSS 3.1 · Vendor: GitHub_M

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Identify Statamic site with user-sortable listing
Delivery

Send GET with crafted sort query parameter
Exploit

Value resolved into unsafe method call on in-memory Collection
Execution

Destructive method executes on entries or assets
Impact

Content and assets deleted

Vulnerability Assessment

Weakness	CWE CWE-470 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V15 - Secure Coding and Architecture Reflection safety, class allowlisting
Exploitation Conditions	Requires a front-end Antlers/Blade template that explicitly passes a request-controlled value (query string, form input, or route parameter) into a Statamic tag's sort parameter against an affected version (<5.73.23 or 6.x <6.20.0); default Statamic templates do not do this, and the vendor explicitly states it is not exploitable by default. Limiting factors: the developer must have built such a dynamic-sort feature, the vulnerable code path is the in-memory collection sort branch (not the query builder, which was fixed in the predecessor CVE), and impact is confined to integrity/availability of content and assets - no confidentiality breach or RCE per the CVSS vector.
Impact	The CVSS 7.4 (AV:N/AC:H/PR:N/UI:N/C:N/I:H/A:H) accurately captures a network-reachable, unauthenticated integrity/availability attack, but AC:H reflects the real-world gate: a developer must have wired request input into a tag's sort parameter, which Statamic explicitly says is not the default. There is no EPSS or SSVC data provided, no KEV listing, and no public exploit identified at time of analysis, so this should be treated as a targeted-deployment risk rather than mass-exploitable. The related earlier advisory (GHSA-4jjr-vmv7-wh4w) flagged unauthenticated REST/GraphQL exposure as critical, so sites that already met that risk profile should assume the front-end sort sink is equally reachable; sites with standard templates face materially lower urgency. Signals are consistent across CVSS, description, and vendor advisory - no conflicts noted.
Exploit ScenarioDerived	An unauthenticated visitor browsing a public Statamic site whose template renders entries with a sort parameter populated from a query string (e.g. ?sort=title) substitutes a crafted value that resolves to a destructive method on the in-memory collection, causing entries or assets to be removed. The attack is delivered with a single HTTP GET to a vulnerable front-end page; no public exploit code is identified at this time, but the kill chain mirrors the previously patched CVE-2026-41175 sink.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 19, 2026

Integrity and availability loss in Statamic CMS versions prior to 5.73.23 and 6.20.0 allows remote attackers to destroy content and assets by manipulating sort parameters that flow into in-memory collection sorting. This is an incomplete-fix follow-up to CVE-2026-41175 (CWE-470, unsafe reflection / method invocation), where the original patch covered the query builder but not the in-memory sort path. No public exploit identified at time of analysis and not in CISA KEV; exploitation requires a non-default template configuration that pipes visitor input into a tag's sort parameter.

RemediationAI

Vendor-released patch: upgrade to Statamic 5.73.23 (5.x branch) or 6.20.0 (6.x branch) via Composer (composer update statamic/cms), per the GitHub Security Advisories at https://github.com/statamic/cms/security/advisories/GHSA-m92m-r54r-x8r2 and https://github.com/statamic/cms/security/advisories/GHSA-4jjr-vmv7-wh4w. If you cannot upgrade immediately, audit all Antlers/Blade templates for tag invocations whose sort parameter is bound to request data (e.g. {{ collection sort="{get:sort}" }} or equivalent), and either hard-code the sort column or whitelist it against a fixed allow-list before passing it into the tag - this removes the attacker-controlled sink at the cost of losing dynamic user-driven sort UX on those pages. Additionally, if the REST or GraphQL APIs are enabled without authentication (the higher-risk configuration called out in the related advisory), disable them or place them behind authentication until patched, accepting the trade-off of breaking any integrations that relied on anonymous access.

Affected VersionsENISA

CMS 6.0.0, < 6.20.0

CMS < 5.73.23

Affected Packages

composer statamic/cms fix: 5.73.23, 6.20.0

euvd cms fix: 5.73.23, 6.20.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in composer, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Statamic is a Laravel- and Git-backed flat-file/CMS framework (cpe:2.3:a:statamic:cms) that exposes Antlers/Blade tag parameters such as a collection's sort argument. CWE-470 (Use of Externally-Controlled Input to Select Classes or Code, aka unsafe reflection) applies here because the sort value is resolved into a method or callable on the underlying Eloquent/Illuminate Collection - when the value is attacker-controlled, the resolution can dispatch unintended methods on model or collection objects, including destructive ones. The earlier fix sanitized the query-builder path (database-level sort), but the same value-resolution logic in the in-memory Collection sort branch was missed, leaving a parallel sink reachable through the same tag parameters.

Know when Statamic gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY 7.4 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

vuln.today AI 7.4 HIGH

Network-reachable via HTTP without auth or interaction (AV:N/PR:N/UI:N); AC:H because exploitation depends on a non-default template wiring request input into a sort parameter; no confidentiality impact, integrity and availability high due to content/asset destruction.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 19, 2026 - 19:02 EUVD

DescriptionCVE.org

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 and 6.20.0, the fix for CVE-2026-41175 was incomplete. It addressed the issue in the query builder, but the same protection was not applied to in-memory collection sorting. Manipulating sort parameters could result in the loss of content and assets. This requires a front-end template that passes request input into a tag's sort parameter. It is not exploitable by default - a template would need to be explicitly set up to sort by a visitor-controlled value. This has been fixed in 5.73.23 and 6.20.0.

Executive ViewAI

Why It Matters

Statamic CMS versions prior to 5.73.23 (5.x) and 6.20.0 (6.x) are vulnerable to remote content and asset destruction through crafted sort parameters in templates; no public exploit identified at time of analysis. The vulnerability poses immediate data integrity and availability risk to organizations running affected CMS versions, particularly those with standard content management configurations. This stems from an incomplete prior security fix that covered query builders but left in-memory sorting paths unpatched.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable all dynamic sort parameters in templates that accept visitor input; (2) Implement strict input validation for any sort parameters that cannot be disabled; (3) Restrict template modification privileges to authorized personnel only; (4) Audit existing templates for unsafe CMS tag usage with user-controlled sort attributes; (5) Enable detailed logging and alerting for template execution anomalies to detect exploitation attempts.

Threat Intelligence Overview

EPSS Score

0.3%

Top 82% exploitable

Threat Intel

1 source

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment GHSA

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.3%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +37

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.