Executive brief
Statamic, a content management system, contained a flaw where public-facing web forms did not properly restrict the types of files users could upload. While critical executable files like PHP were still blocked by a global safety list, an unauthenticated visitor could bypass specific administrator-defined restrictions to upload unauthorized file types to the server. This could lead to the storage of unwanted content on public, web-accessible disks, potentially impacting storage costs or site reputation.
Technical details
A vulnerability exists in Statamic CMS where frontend forms do not enforce the same file upload validation rules as the administrative Control Panel. An unauthenticated remote attacker can exploit this by submitting files through 'assets' or 'files' fields that bypass administrator-defined extension restrictions. While Statamic's global allowlist prevents the upload of dangerous executable types like .php or .html, other disallowed types can be successfully uploaded to public, web-accessible storage. The issue is fixed in versions 5.74.3 and 6.24.2.
Affected products
- Statamic CMS < 5.74.3, >= 6.0.0, < 6.24.2
Timeline
- 2026-07-09: disclosed: Initial disclosure by reporter
- 2026-08-06: advisory: GitHub Advisory published
- 2026-08-06: patched: Fixes released in versions 5.74.3 and 6.24.2