CVE-2026-71435

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, the default ("automagic") form notification email rendered user-submitted values without escaping, allowing an unauthenticated form submitter to inject HTML into the notification emails sent to the configured recipients. This issue is fixed in versions 5.74.3 and 6.24.2.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/statamic/cms/commit/4ad1335e818a67249d0617f0f167a1198fb96a2c
https://github.com/statamic/cms/pull/14959
https://github.com/statamic/cms/releases/tag/v5.74.3
https://github.com/statamic/cms/releases/tag/v6.24.2
https://github.com/statamic/cms/security/advisories/GHSA-vx89-p3j7-8xqc

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-06 22:18

Updated : 2026-09-08 20:51

NVD link : CVE-2026-71435

Mitre link : CVE-2026-71435

CVE.ORG link : CVE-2026-71435

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-71435", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71435", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-08T02:31:13.526218Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "statamic", "product": "cms", "versions": [{"status": "affected", "version": "< 5.74.3"}, {"status": "affected", "version": ">= 6.0.0, < 6.24.2"}]}]}], "published": "2026-08-06T22:18:30.423", "references": [{"url": "https://github.com/statamic/cms/commit/4ad1335e818a67249d0617f0f167a1198fb96a2c", "source": "security-advisories@github.com"}, {"url": "https://github.com/statamic/cms/pull/14959", "source": "security-advisories@github.com"}, {"url": "https://github.com/statamic/cms/releases/tag/v5.74.3", "source": "security-advisories@github.com"}, {"url": "https://github.com/statamic/cms/releases/tag/v6.24.2", "source": "security-advisories@github.com"}, {"url": "https://github.com/statamic/cms/security/advisories/GHSA-vx89-p3j7-8xqc", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, the default (\"automagic\") form notification email rendered user-submitted values without escaping, allowing an unauthenticated form submitter to inject HTML into the notification emails sent to the configured recipients. This issue is fixed in versions 5.74.3 and 6.24.2."}], "lastModified": "2026-09-08T20:51:43.490", "sourceIdentifier": "security-advisories@github.com"}