Is CVE-2026-71435 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-71435 being exploited in the wild.

How severe is CVE-2026-71435?

Medium severity, with a CVSS score of 6.1, published 6 August 2026.

Which products and versions are affected?

statamic/cms (Packagist) ECOSYSTEM:introduced=0,fixed=5.74.3.

Is there a fix for CVE-2026-71435?

Yes. statamic/cms (Packagist): upgrade to 5.74.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-71435 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-71435?

Check whether you run statamic/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-71435: Statamic CMS stored XSS in form notification email template

CVE-2026-71435 · Severity: medium · CVSS 6.1 · Published 2026-08-06

Statamic, a content management system, contains a vulnerability in its automated form notification system. An attacker can submit malicious code through a website form that is then executed when a site administrator opens the resulting notification email. This could allow an attacker to perform unauthorized actions in the administrator's browser or steal sensitive session information.

Technologies: statamic/cms (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-71435 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-71435 being exploited in the wild.
How severe is CVE-2026-71435?: Medium severity, with a CVSS score of 6.1, published 6 August 2026.
Which products and versions are affected?: statamic/cms (Packagist) ECOSYSTEM:introduced=0,fixed=5.74.3.
Is there a fix for CVE-2026-71435?: Yes. statamic/cms (Packagist): upgrade to 5.74.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-71435 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-71435?: Check whether you run statamic/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

statamic/cms (Packagist): upgrade to 5.74.3 or later
```
composer require statamic/cms:^5.74.3
```

Technical details

A stored cross-site scripting (XSS) vulnerability exists in Statamic CMS within the 'automagic' form notification email component. The root cause is the failure to escape user-provided input before rendering it in the HTML email template sent to administrators. An unauthenticated remote attacker can exploit this by submitting a form containing malicious HTML/JavaScript. When a recipient (typically an administrator) views the notification email in a client that renders HTML, the payload executes in the context of the recipient's session. This has been patched in versions 5.74.3 and 6.24.2.

Affected products

Statamic Statamic CMS < 5.74.3, >= 6.0.0, < 6.24.2

Identifiers

CVE-2026-71435
GHSA-vx89-p3j7-8xqc

Timeline

2026-07-09: disclosed: Initial disclosure by vendor
2026-08-06: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.