Is CVE-2026-71434 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-71434 being exploited in the wild.

How severe is CVE-2026-71434?

Medium severity, with a CVSS score of 5.3, published 6 August 2026.

Which products and versions are affected?

statamic/cms (Packagist) ECOSYSTEM:introduced=0,fixed=5.74.3; Statamic = 6.0.0, < 6.24.2.

Is there a fix for CVE-2026-71434?

Yes. statamic/cms (Packagist): upgrade to 5.74.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-71434 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-71434?

Check whether you run statamic/cms (Packagist) or Statamic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-71434: Statamic CMS unrestricted file upload in frontend forms

Q: Is there a fix for CVE-2026-71434?

Yes. statamic/cms (Packagist): upgrade to 5.74.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-71434 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-71434?

Check whether you run statamic/cms (Packagist) or Statamic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-71434 · Severity: medium · CVSS 5.3 · Published 2026-08-06

Statamic, a content management system, contained a flaw where public-facing web forms did not properly restrict the types of files users could upload. While critical executable files like PHP were still blocked by a global safety list, an unauthenticated visitor could bypass specific administrator-defined restrictions to upload unauthorized file types to the server. This could lead to the storage of unwanted content on public, web-accessible disks, potentially impacting storage costs or site reputation.

Technologies: statamic/cms (Packagist), Statamic. Vendors: Packagist, Statamic.

Quick answers

Is CVE-2026-71434 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-71434 being exploited in the wild.
How severe is CVE-2026-71434?: Medium severity, with a CVSS score of 5.3, published 6 August 2026.
Which products and versions are affected?: statamic/cms (Packagist) ECOSYSTEM:introduced=0,fixed=5.74.3; Statamic < 5.74.3, >= 6.0.0, < 6.24.2.
Is there a fix for CVE-2026-71434?: Yes. statamic/cms (Packagist): upgrade to 5.74.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-71434 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-71434?: Check whether you run statamic/cms (Packagist) or Statamic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

statamic/cms (Packagist): upgrade to 5.74.3 or later
```
composer require statamic/cms:^5.74.3
```

Technical details

A vulnerability exists in Statamic CMS where frontend forms do not enforce the same file upload validation rules as the administrative Control Panel. An unauthenticated remote attacker can exploit this by submitting files through 'assets' or 'files' fields that bypass administrator-defined extension restrictions. While Statamic's global allowlist prevents the upload of dangerous executable types like .php or .html, other disallowed types can be successfully uploaded to public, web-accessible storage. The issue is fixed in versions 5.74.3 and 6.24.2.

Affected products

Statamic CMS < 5.74.3, >= 6.0.0, < 6.24.2

Identifiers

CVE-2026-71434
GHSA-qhr7-v3xp-vw9m

Timeline

2026-07-09: disclosed: Initial disclosure by reporter
2026-08-06: advisory: GitHub Advisory published
2026-08-06: patched: Fixes released in versions 5.74.3 and 6.24.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.