EUVD-2026-54237
GHSA-qhr7-v3xp-vw9m
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network vector with no authentication since frontend forms are public; integrity limited to bypassing admin-configured extension lists, not executing code.
Primary rating from Vendor (https://github.com/statamic/cms).
CVSS VectorVendor: https://github.com/statamic/cms
Lifecycle Timeline
2DescriptionCVE.org
Impact
Public frontend forms did not enforce the file upload restrictions that the Control Panel enforces, so an unauthenticated visitor could upload file types an administrator had intended to disallow through a form's assets or files field. For assets fields, files could be stored on a public, web-accessible disk. Statamic's global upload allowlist still applied, so executable types such as .php and .html remained blocked.
Patches
This has been fixed in 5.74.3 and 6.24.2.
AnalysisAI
Frontend form upload validation in Statamic CMS fails to enforce administrator-configured file type restrictions, allowing unauthenticated visitors to upload disallowed extensions through public-facing forms containing assets or files fields. The bypass is constrained: Statamic's global allowlist continues to block truly dangerous executable types such as .php and .html, meaning direct remote code execution is not achievable through this flaw alone. No public exploit code has been identified at time of analysis; vendor-released patches are available in versions 5.74.3 and 6.24.2.
Technical ContextAI
Statamic is a Laravel-based flat-file PHP CMS where form submissions are handled by FrontendFormRequest.php. Prior to the fix, this class applied the global AllowedFile validation rule to assets fields but entirely omitted validation for files fields and - critically - never consulted per-container validation rules (e.g., extensions:jpg,png configured on an AssetContainer). The patch (PR #14958, commit 8be7b6c) extends filtering to both assets and files field types and adds an assetContainerRules() helper that resolves the relevant AssetContainer, reads its validationRules(), and merges them into the Laravel validator. CWE-434 (Unrestricted Upload of File with Dangerous Type) precisely describes this root cause: the application accepts a user-supplied file without adequately verifying that its type matches the intended policy.
RemediationAI
Upgrade Statamic CMS to version 5.74.3 (for 5.x deployments) or 6.24.2 (for 6.x deployments); both releases are confirmed at https://github.com/statamic/cms/releases/tag/v5.74.3 and https://github.com/statamic/cms/releases/tag/v6.24.2 respectively, with the underlying fix in PR #14958 (https://github.com/statamic/cms/pull/14958). For sites unable to patch immediately, the most effective compensating control is to remove assets and files field types from all public-facing frontend forms, at the cost of disabling upload functionality for those forms. A secondary option is to enforce server-level upload restrictions via Nginx deny rules on file extensions or Apache FilesMatch directives, though these must be carefully aligned with intended business rules and introduce operational overhead when allowed extensions change. There are no known adverse side effects from applying the vendor patch itself.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today