What is the CVSS score of CVE-2026-71435?

CVE-2026-71435 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-71435?

Yes, a patch is available for CVE-2026-71435. Update the affected software to the latest version immediately.

Statamic CMS CVE-2026-71435

EUVD-2026-54239 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-06 https://github.com/statamic/cms

GHSA-vx89-p3j7-8xqc

XSS

6.1

CVSS 3.1 · Vendor: https://github.com/statamic/cms

Severity by source

Vendor (https://github.com/statamic/cms) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Network-accessible form submission requires no privileges; scope changes to email client; impact bounded to low C/I with no availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (https://github.com/statamic/cms).

CVSS VectorVendor: https://github.com/statamic/cms

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Aug 06, 2026 - 20:08 vuln.today

Analysis Generated

Aug 06, 2026 - 20:08 vuln.today

DescriptionCVE.org

Impact

The default ("automagic") form notification email rendered user-submitted values without escaping, allowing an unauthenticated form submitter to inject HTML into the notification emails sent to the configured recipients

Patches

This has been fixed in 5.74.3 and 6.24.2.

AnalysisAI

HTML injection via unescaped form submissions in Statamic CMS's automagic email notification template allows unauthenticated attackers to deliver malicious HTML content to site administrators and other configured email recipients. Statamic's Antlers templating engine rendered all user-controlled form field values - including text, select, radio, and checkbox inputs - directly into HTML email bodies without sanitization, enabling payload delivery through a standard public-facing form submission. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vulnerability requires no authentication and is accessible to any user who can submit a Statamic form.

Technical ContextAI

Statamic CMS is a Laravel-based PHP flat-file CMS using the Antlers templating engine. The 'automagic' form notification feature auto-generates HTML email bodies from form submissions without requiring a custom email template. The vulnerability resides in resources/views/forms/automagic-email.antlers.html, where Antlers variables like {{ value:label ?? value }} were rendered without the | sanitize filter, causing raw user input to be interpolated directly into the HTML email payload. CWE-79 (Improper Neutralization of Input During Web Page Generation / XSS) applies here in an email rendering context rather than a browser DOM context. Affected packages are composer/statamic/cms versions prior to 5.74.3 (v5 branch) and versions 6.0.0 through 6.24.1 (v6 branch).

RemediationAI

Upgrade to Statamic CMS 5.74.3 (v5 branch) or 6.24.2 (v6 branch), both of which are confirmed fixed releases per the GitHub advisory GHSA-vx89-p3j7-8xqc (https://github.com/statamic/cms/security/advisories/GHSA-vx89-p3j7-8xqc) and the tagged releases at https://github.com/statamic/cms/releases/tag/v5.74.3 and https://github.com/statamic/cms/releases/tag/v6.24.2. The fix applies the | sanitize filter to all user-controlled output variables in the automagic email template (PR https://github.com/statamic/cms/pull/14959, commit 4ad1335e818a67249d0617f0f167a1198fb96a2c). As a compensating control prior to patching, site operators can configure a custom form notification email template that uses explicit escaping, bypassing the automagic template entirely - this disables the convenience feature but removes the vulnerable code path with no other functional side effects.