EUVD-2026-54237
GHSA-qhr7-v3xp-vw9m
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network vector with no authentication since frontend forms are public; integrity limited to bypassing admin-configured extension lists, not executing code.
Primary rating from Vendor (https://github.com/statamic/cms).
CVSS VectorVendor: https://github.com/statamic/cms
Lifecycle Timeline
2DescriptionCVE.org
Impact
Public frontend forms did not enforce the file upload restrictions that the Control Panel enforces, so an unauthenticated visitor could upload file types an administrator had intended to disallow through a form's assets or files field. For assets fields, files could be stored on a public, web-accessible disk. Statamic's global upload allowlist still applied, so executable types such as .php and .html remained blocked.
Patches
This has been fixed in 5.74.3 and 6.24.2.
AnalysisAI
Frontend form upload validation in Statamic CMS fails to enforce administrator-configured file type restrictions, allowing unauthenticated visitors to upload disallowed extensions through public-facing forms containing assets or files fields. The bypass is constrained: Statamic's global allowlist continues to block truly dangerous executable types such as .php and .html, meaning direct remote code execution is not achievable through this flaw alone. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) the target Statamic installation must have at least one public-facing frontend form with an `assets` or `files` field type configured - this is a non-default feature requiring deliberate setup by a site administrator; (2) that form must be accessible without authentication, which is the typical use case for contact/survey forms but not universal; (3) the administrator must have configured per-container extension restrictions on the relevant `AssetContainer` (e.g., `extensions:jpg,png`), since without such restrictions the bypass produces no additional impact beyond what Statamic's global allowlist already permits; (4) for `assets` fields, meaningful exposure requires that the configured asset container uses a publicly web-accessible disk. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 5.3 Medium (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) reflects the narrow integrity impact: an attacker can store files of types the administrator intended to block, but cannot achieve code execution because Statamic's global allowlist blocks `.php`, `.html`, and other executable types. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Statamic CMS to version 5.74.3 (for 5.x deployments) or 6.24.2 (for 6.x deployments); both releases are confirmed at https://github.com/statamic/cms/releases/tag/v5.74.3 and https://github.com/statamic/cms/releases/tag/v6.24.2 respectively, with the underlying fix in PR #14958 (https://github.com/statamic/cms/pull/14958). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today