# CVE-2026-49287: Statamic CMS unsafe reflection in collection sorting

Source: https://junglewise.ai/threats/cve-2026-49287-statamic-cms-unsafe-reflection-in-collection-sorting  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-19. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-49287 · Severity: high · CVSS 7.4 · Published 2026-06-19

Statamic CMS, a content management system, contains a vulnerability that could allow an attacker to delete website content and assets. This occurs when a website's design allows visitors to control how lists of items are sorted. If exploited, this could lead to significant data loss and disruption of website operations.

Technologies: [statamic/cms (Packagist)](https://junglewise.ai/threats/technologies/statamic-cms), [Statamic](https://junglewise.ai/threats/technologies/statamic). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Statamic](https://junglewise.ai/threats/vendors/statamic).

## Quick answers

**Is CVE-2026-49287 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49287 being exploited in the wild.

**How severe is CVE-2026-49287?** High severity, with a CVSS score of 7.4, published 19 June 2026.

**Which products and versions are affected?** statamic/cms (Packagist) ECOSYSTEM:introduced=0,fixed=5.73.23; Statamic < 5.73.23, >= 6.0.0 < 6.20.0, < 5.73.23, >= 6.0.0, < 6.20.0.

**Is there a fix for CVE-2026-49287?** Yes. statamic/cms (Packagist): upgrade to 5.73.23 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-49287 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-49287?** Check whether you run statamic/cms (Packagist) or Statamic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- statamic/cms (Packagist): upgrade to 5.73.23 or later

  ```sh
  composer require statamic/cms:^5.73.23
  ```


## Technical details

Statamic CMS is vulnerable to unsafe reflection (CWE-470) due to an incomplete fix for a previous vulnerability. The issue resides in how the CMS handles in-memory collection sorting when sort parameters are passed directly from request input to a template tag. An attacker can manipulate these sort parameters to invoke unintended methods, potentially leading to the deletion of content and assets. This vulnerability is only exploitable if a front-end template is explicitly configured to use visitor-controlled values for sorting. Patches are available in versions 5.73.23 and 6.20.0.

## Affected products

- Statamic Statamic CMS < 5.73.23, >= 6.0.0, < 6.20.0

## Identifiers

- CVE-2026-49287
- GHSA-m92m-r54r-x8r2

## Timeline

- 2026-05-25: disclosed
- 2026-06-19: advisory: NVD publication date
- 2026-06-26: advisory: GitHub Advisory published

## References

- [https://api.github.com/users/Eszh](https://api.github.com/users/Eszh)
- [https://github.com/Eszh](https://github.com/Eszh)
- [https://api.github.com/users/Eszh/gists%7B/gist_id%7D](https://api.github.com/users/Eszh/gists%7B/gist_id%7D)
- [https://api.github.com/users/Eszh/repos](https://api.github.com/users/Eszh/repos)
- [https://avatars.githubusercontent.com/u/63902427?v=4](https://avatars.githubusercontent.com/u/63902427?v=4)
- [https://api.github.com/users/Eszh/events%7B/privacy%7D](https://api.github.com/users/Eszh/events%7B/privacy%7D)

## Related threats

- [Statamic CMS stored XSS in form notification email template](https://junglewise.ai/threats/cve-2026-71435-statamic-cms-stored-xss-in-form-notification-email-template)
- [Statamic CMS unrestricted file upload in frontend forms](https://junglewise.ai/threats/cve-2026-71434-statamic-cms-unrestricted-file-upload-in-frontend-forms)
- [Statamic CMS account takeover via OAuth email matching](https://junglewise.ai/threats/cve-2026-64665-statamic-cms-account-takeover-via-oauth-email-matching)
- [Statamic CMS missing authorization in Control Panel user wizard](https://junglewise.ai/threats/cve-2026-64664-statamic-cms-missing-authorization-in-control-panel-user-wizard)
- [Statamic CMS unsafe reflection in Antlers template resolution](https://junglewise.ai/threats/cve-2026-64663-statamic-cms-unsafe-reflection-in-antlers-template-resolution)