EUVD-2026-54233
GHSA-j2vp-f2pv-5rj4
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
AC:H reflects the required non-default template configuration; PR:N confirmed by advisory; A:H for irreversible content/asset destruction; C:N as no disclosure impact described.
Primary rating from Vendor (https://github.com/statamic/cms).
CVSS VectorVendor: https://github.com/statamic/cms
Lifecycle Timeline
3DescriptionCVE.org
Impact
Manipulating user-supplied input incorporated into Antlers templates could result in the loss of content and assets.
Exploitation requires a site to have templates that pass untrusted input into affected areas. It does not require authentication.
Patches
This has been fixed in 5.74.1 and 6.24.0.
AnalysisAI
Unsafe method invocation via Antlers template resolution in Statamic CMS enables unauthenticated remote attackers to destroy content and stored assets on affected installations. Sites running statamic/cms below 5.74.1 or in the 6.x line below 6.24.0 are vulnerable when their templates incorporate user-supplied input into Antlers template resolution - a deployment pattern present on developer-facing or dynamic sites. No public exploit or CISA KEV listing is identified at time of analysis; the CVSS AC:H rating reflects the required site-configuration precondition, tempering real-world exposure despite the destructive impact.
Technical ContextAI
Statamic is a flat-file, Laravel-based content management system whose native Antlers templating language evaluates expressions directly in PHP. CWE-470 (Use of Externally-Controlled Input to Select Classes or Code) describes the root cause: when user-supplied data is passed into Antlers template resolution without sanitization, the engine can be directed to invoke methods not intended to be callable from template context. In Statamic's architecture, Antlers can resolve PHP object methods on content models and asset managers, meaning method-invocation abuse can reach deletion or mutation operations on the underlying flat-file data store and asset filesystem. The affected packages are composer/statamic/cms versions < 5.74.1 and >= 6.0.0, < 6.24.0, as confirmed by CPE data and the GitHub Security Advisory GHSA-j2vp-f2pv-5rj4.
RemediationAI
The primary fix is to upgrade statamic/cms to version 5.74.1 (for v5 users) or 6.24.0 (for v6 users) via Composer: run 'composer update statamic/cms' and confirm the installed version meets the fixed threshold. Full advisory details are at https://github.com/statamic/cms/security/advisories/GHSA-j2vp-f2pv-5rj4. If immediate patching is not possible, the most targeted compensating control is to audit all Antlers templates and remove or sanitize any template tags that incorporate user-supplied request input directly into method-resolution expressions - specifically, avoid passing raw query parameters, form fields, or route segments into Antlers variable resolution without explicit allowlisting. This mitigation requires code-level review of templates and may break dynamic template patterns intentionally built on user input. No vendor-described workaround was provided beyond patching.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today