CVE-2026-71435: Statamic CMS stored XSS in form notification email template

Executive brief

Statamic, a content management system, contains a vulnerability in its automated form notification system. An attacker can submit malicious code through a website form that is then executed when a site administrator opens the resulting notification email. This could allow an attacker to perform unauthorized actions in the administrator's browser or steal sensitive session information.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in Statamic CMS within the 'automagic' form notification email component. The root cause is the failure to escape user-provided input before rendering it in the HTML email template sent to administrators. An unauthenticated remote attacker can exploit this by submitting a form containing malicious HTML/JavaScript. When a recipient (typically an administrator) views the notification email in a client that renders HTML, the payload executes in the context of the recipient's session. This has been patched in versions 5.74.3 and 6.24.2.

Affected products

• Statamic Statamic CMS < 5.74.3, >= 6.0.0, < 6.24.2

Timeline

• 2026-07-09: disclosed: Initial disclosure by vendor
• 2026-08-06: advisory: GitHub Advisory published

References

• https://api.github.com/users/ya3raj
• https://github.com/ya3raj
• https://api.github.com/users/ya3raj/gists%7B/gist_id%7D
• https://api.github.com/users/ya3raj/repos
• https://avatars.githubusercontent.com/u/59885197?v=4
• https://api.github.com/users/ya3raj/events%7B/privacy%7D