CVE-2026-64663

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, manipulating user-supplied input incorporated into Antlers templates could result in the loss of content and assets, on sites whose templates pass untrusted input into affected areas, and exploitation did not require authentication. This issue is fixed in versions 5.74.1 and 6.24.0.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/statamic/cms/security/advisories/GHSA-j2vp-f2pv-5rj4

Configurations

No configuration.

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Statamic es un sistema de gestión de contenido (CMS) impulsado por Laravel y Git. Antes de las versiones 5.74.1 y 6.24.0, la manipulación de la entrada proporcionada por el usuario incorporada en las plantillas de Antlers podría resultar en la pérdida de contenido y activos, en sitios cuyas plantillas pasan entrada no confiable a áreas afectadas, y la explotación no requería autenticación. Este problema está solucionado en las versiones 5.74.1 y 6.24.0.

Information

Published : 2026-08-06 22:18

Updated : 2026-10-24 16:10

NVD link : CVE-2026-64663

Mitre link : CVE-2026-64663

CVE.ORG link : CVE-2026-64663

JSON object : View

Products Affected

No product.

CWE

CWE-470

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

{"id": "CVE-2026-64663", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-64663", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-07T17:38:50.389929Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "statamic", "product": "cms", "versions": [{"status": "affected", "version": "< 5.74.1"}, {"status": "affected", "version": ">= 6.0.0, < 6.24.0"}]}]}], "published": "2026-08-06T22:18:13.820", "references": [{"url": "https://github.com/statamic/cms/security/advisories/GHSA-j2vp-f2pv-5rj4", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-470"}]}], "descriptions": [{"lang": "en", "value": "Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, manipulating user-supplied input incorporated into Antlers templates could result in the loss of content and assets, on sites whose templates pass untrusted input into affected areas, and exploitation did not require authentication. This issue is fixed in versions 5.74.1 and 6.24.0."}, {"lang": "es", "value": "Statamic es un sistema de gesti\u00f3n de contenido (CMS) impulsado por Laravel y Git. Antes de las versiones 5.74.1 y 6.24.0, la manipulaci\u00f3n de la entrada proporcionada por el usuario incorporada en las plantillas de Antlers podr\u00eda resultar en la p\u00e9rdida de contenido y activos, en sitios cuyas plantillas pasan entrada no confiable a \u00e1reas afectadas, y la explotaci\u00f3n no requer\u00eda autenticaci\u00f3n. Este problema est\u00e1 solucionado en las versiones 5.74.1 y 6.24.0."}], "lastModified": "2026-10-24T16:10:00.153", "sourceIdentifier": "security-advisories@github.com"}