Executive brief
Statamic, a content management system, is vulnerable to a flaw that could allow an attacker to delete website content and assets. This occurs when user-provided data is improperly handled by the system's template engine. If a site uses templates that process untrusted input in specific ways, an unauthenticated attacker could trigger the destruction of data, potentially leading to service disruption and loss of digital assets.
Technical details
Statamic CMS is vulnerable to unsafe reflection (CWE-470) within its Antlers template engine. The vulnerability arises when user-supplied input is incorporated into Antlers templates and subsequently used to select or invoke classes or code without sufficient validation. An unauthenticated remote attacker can exploit this by providing malicious input to templates that pass untrusted data into affected areas, leading to unauthorized method invocation and data destruction. The attack complexity is rated as high, likely due to the requirement for specific template configurations to be present. The issue has been patched in versions 5.74.1 and 6.24.0.
Affected products
- Statamic Statamic CMS < 5.74.1, >= 6.0.0, < 6.24.0
Timeline
- 2026-07-02: disclosed: Advisory published by researcher
- 2026-08-06: advisory: GitHub Advisory published/reviewed
- 2026-08-06: patched: Fixes released in versions 5.74.1 and 6.24.0